@openclaw/codex 2026.10.5-beta.3 → 2026.10.5

package/dist/.setup/{settled-turn-finalizer-C6tjH8RJ.mjs → settled-turn-finalizer-Blsc4VLX.mjs}

@@ -1,12 +1,12 @@
 import { i as readMirrorIdentity, n as attachCodexMirrorIdentity } from "./upstream-prompt-provenance-Ccd9MFRJ.mjs";
 import { l as readCodexMirrorSourceFingerprint, o as fingerprintCodexMirrorSourceMessage } from "./transcript-mirror-attestation-BzUXnrvv.mjs";
-import { nt as resolveCodexAppServerPreparedAuthHandoff } from "./shared-client-CCz9ldpr.mjs";
-import { f as assertCodexPassiveTurnItems } from "./client-aPKNc4Ii.mjs";
-import { runBoundedCodexAppServerTurn } from "./bounded-turn-BmChqNaK.mjs";
+import { nt as resolveCodexAppServerPreparedAuthHandoff } from "./shared-client-wb1JBldZ.mjs";
+import { f as assertCodexPassiveTurnItems } from "./client-BpSxNz4F.mjs";
+import { runBoundedCodexAppServerTurn } from "./bounded-turn-BpjZixcd.mjs";
 import { t as resolveCodexLocalRuntimeAttribution } from "./local-runtime-attribution-CZz2DJ4q.mjs";
-import { t as resolveCodexBoundedTurnIsolation } from "./bounded-turn-isolation-BfDAo-qZ.mjs";
+import { t as resolveCodexBoundedTurnIsolation } from "./bounded-turn-isolation-Brj5qzz6.mjs";
 import { a as createAttributedCodexAssistantMessage } from "./event-projector-assistant-message-CLMKN4x-.mjs";
-import { t as codexTranscriptMirrorRuntime } from "./transcript-mirror-Bee2o6jj.mjs";
+import { t as codexTranscriptMirrorRuntime } from "./transcript-mirror-DVEzdOs0.mjs";
 import { t as CodexSettledTurnContext } from "./settled-turn-context-BPL6D3RO.mjs";
 import { createNativeSessionBindingAuthority } from "openclaw/plugin-sdk/agent-harness-session-runtime";
 import { isSilentReplyText } from "openclaw/plugin-sdk/reply-runtime";

package/dist/.setup/{shared-client-CCz9ldpr.mjs → shared-client-wb1JBldZ.mjs}

@@ -1,23 +1,23 @@
 import { i as isJsonObject } from "./protocol-CANUwXJ3.mjs";
-import { n as defineCodexBuildState, t as codexBuildSymbol } from "./build-state-sjOWPg_o.mjs";
+import { n as defineCodexBuildState, t as codexBuildSymbol } from "./build-state-DfrctLQv.mjs";
 import { t as CODEX_APP_SERVER_AUTH_PROVIDER } from "./auth-profile-selection-hr8ocLtz.mjs";
 import { n as isCodexAppServerProxyLaunch } from "./launch-args-DbFCehO7.mjs";
 import { a as withEphemeralCodexAuthStore, i as withClearedEnvironmentVariables, n as resolveCodexAppServerLocalHomeDir, r as resolveCodexAppServerUserHomeDir, t as resolveCodexAppServerHomeDir } from "./auth-start-options-BPIPeEX8.mjs";
-import { a as resolveCodexAppServerStartOptionsForAgent, d as readCodexEffectiveConfig, o as resolveCodexComputerUseConfig, t as codexAppServerStartOptionsKey, u as CODEX_SESSION_OVERRIDABLE_LAYER_TYPES } from "./config-options-DDzeNQ8m.mjs";
-import { d as resolveMacOSDesktopCodexBundledMarketplaceCandidates, f as resolveMacOSDesktopCodexComputerUseServiceAppCandidates, i as resolveManagedCodexNativeCommand, l as resolveFirstExistingMacOSDesktopCodexBundledMarketplacePath, r as resolveManagedCodexAppServerStartOptions, t as isManagedCodexDesktopCommand, u as resolveMacOSDesktopCodexAppPathCandidates } from "./managed-binary-BtIjV7yN.mjs";
-import { A as waitForCodexDesktopGeneration, C as retirePendingSharedClientEntryIfUnclaimed, D as waitForUnclaimedSharedClientStartup, _ as observeSharedClientAcquire, a as readCodexCliAuthFileApiKey, b as releaseSharedClientEntry, c as resolveCodexAppServerPreparedApiKeyCacheKey, d as getCurrentSharedClientEntry, f as getOrCreateSharedClientEntry, g as observeAcquire, h as notifyDesktopGenerationDrainChecks, i as fingerprintTokenAuthProfileCacheKey, j as readCodexDesktopArtifactTreeFingerprint, k as isCodexDesktopGenerationCurrent, l as closeSharedClientEntryIfUnclaimed, n as CODEX_AUTH_JSON_FILENAME, o as readFirstNonEmptyEnv, p as getSharedCodexAppServerClientState, r as fingerprintApiKeyAuthProfileCacheKey, s as resolveCodexAppServerFallbackApiKeyCacheKey, t as CODEX_APP_SERVER_API_KEY_ENV_VARS, u as createCodexAppServerStartupLifetime, v as ownCodexStartup, w as retireSharedCodexAppServerClientIfCurrent, x as retainSharedClientEntry, y as recordSharedClientAcquireBoundary } from "./auth-cache-key-BzYrcgwJ.mjs";
-import { n as resolveCodexAppServerSpawnEnv } from "./transport-stdio-CRWTkKOn.mjs";
+import { a as resolveCodexAppServerStartOptionsForAgent, d as readCodexEffectiveConfig, o as resolveCodexComputerUseConfig, t as codexAppServerStartOptionsKey, u as CODEX_SESSION_OVERRIDABLE_LAYER_TYPES } from "./config-options-nvYwVDyy.mjs";
+import { d as resolveMacOSDesktopCodexBundledMarketplaceCandidates, f as resolveMacOSDesktopCodexComputerUseServiceAppCandidates, i as resolveManagedCodexNativeCommand, l as resolveFirstExistingMacOSDesktopCodexBundledMarketplacePath, r as resolveManagedCodexAppServerStartOptions, t as isManagedCodexDesktopCommand, u as resolveMacOSDesktopCodexAppPathCandidates } from "./managed-binary-DwC9wxch.mjs";
+import { A as waitForCodexDesktopGeneration, C as retirePendingSharedClientEntryIfUnclaimed, D as waitForUnclaimedSharedClientStartup, _ as observeSharedClientAcquire, a as readCodexCliAuthFileApiKey, b as releaseSharedClientEntry, c as resolveCodexAppServerPreparedApiKeyCacheKey, d as getCurrentSharedClientEntry, f as getOrCreateSharedClientEntry, g as observeAcquire, h as notifyDesktopGenerationDrainChecks, i as fingerprintTokenAuthProfileCacheKey, j as readCodexDesktopArtifactTreeFingerprint, k as isCodexDesktopGenerationCurrent, l as closeSharedClientEntryIfUnclaimed, n as CODEX_AUTH_JSON_FILENAME, o as readFirstNonEmptyEnv, p as getSharedCodexAppServerClientState, r as fingerprintApiKeyAuthProfileCacheKey, s as resolveCodexAppServerFallbackApiKeyCacheKey, t as CODEX_APP_SERVER_API_KEY_ENV_VARS, u as createCodexAppServerStartupLifetime, v as ownCodexStartup, w as retireSharedCodexAppServerClientIfCurrent, x as retainSharedClientEntry, y as recordSharedClientAcquireBoundary } from "./auth-cache-key-DvDLHVJe.mjs";
+import { n as resolveCodexAppServerSpawnEnv } from "./transport-stdio-lgeKKHyw.mjs";
 import { n as CodexAppServerAuthProfileUnavailableError, r as formatCodexAuthProfileUnavailableMessage } from "./auth-profile-recovery-BREezV0L.mjs";
 import { a as codexPrewriteRejectionCause } from "./rpc-error-C98SHchT.mjs";
 import { i as withTimeout } from "./timeout-D0mEWSGG.mjs";
 import { n as readCodexSessionMeta } from "./session-catalog-provenance-CmsOE5mh.mjs";
-import { n as observeCodexCatalogClient } from "./session-catalog-events-DujfzcAY.mjs";
-import { n as resolveCodexAppServerRuntimeOptions } from "./config-runtime-DWzK-k0n.mjs";
+import { n as observeCodexCatalogClient } from "./session-catalog-events-IoszcO7-.mjs";
+import { n as resolveCodexAppServerRuntimeOptions } from "./config-runtime-B8agjie6.mjs";
 import { a as resolveCodexAppServerAuthProfileStore, i as resolveCodexAppServerAuthProfileIdForAgent, r as resolveCodexAppServerAuthProfileId, t as isCodexAppServerNativeAuthProfile } from "./auth-profile-CgHQ8Vot.mjs";
 import { i as isCodexResponsesOAuthCredential, n as createCodexResponsesOAuth, o as resolveCodexResponsesOAuthProfileFingerprint, r as isCodexResponsesOAuth, t as CODEX_RESPONSES_OAUTH_PROVIDER } from "./responses-oauth-twnuTaAa.mjs";
-import { N as isUnsupportedCodexAppServerVersionError, t as CodexAppServerClient } from "./client-aPKNc4Ii.mjs";
-import { n as isCodexWebSocketOpenFailure } from "./transport-websocket-DIyPfkHo.mjs";
-import { t as __exportAll } from "./session-binding-sidecars-DD-enC8w.mjs";
+import { N as isUnsupportedCodexAppServerVersionError, t as CodexAppServerClient } from "./client-BpSxNz4F.mjs";
+import { n as isCodexWebSocketOpenFailure } from "./transport-websocket-DOY0dJXN.mjs";
+import { t as __exportAll } from "./session-binding-sidecars-DijNZb31.mjs";
 import { asOptionalRecord, isRecord } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { createHash, randomUUID } from "node:crypto";
 import { isDeepStrictEqual } from "node:util";
@@ -2486,7 +2486,7 @@ async function prepareCodexInferenceRoute(params) {
 			}
 			pending = Promise.all([
 				import("./inference-proxy-BDWV0djM.mjs"),
-				import("./native-subagent-monitor-DC4clzAD.mjs").then((n) => n.n),
+				import("./native-subagent-monitor-gqu3TQOv.mjs").then((n) => n.n),
 				import("./inference-dispatch-CO6tTs4q.mjs")
 			]).then(([{ createCodexInferenceProxy }, native, { createCodexInferenceModelBinding }]) => {
 				assertClient();
@@ -3301,7 +3301,7 @@ async function startInitializedCodexAppServerClientOnce(params) {
 		} finally {
 			artifactDrain?.cancel();
 		}
-		const runtimeArtifactModule = params.runtimeArtifactMode ? await import("./runtime-artifact-C13pR7tD.mjs") : void 0;
+		const runtimeArtifactModule = params.runtimeArtifactMode ? await import("./runtime-artifact-nFHy1R0x.mjs") : void 0;
 		const runtimeArtifactBeforeStart = runtimeArtifactModule ? await runtimeArtifactModule.captureCodexAppServerRuntimeArtifactBeforeStart({
 			startOptions,
 			spawnIdentity: resolveCodexAppServerSpawnIdentity(startOptions),

package/dist/.setup/{side-question-COaYBoON.mjs → side-question-DNEeROvz.mjs}

@@ -1,29 +1,29 @@
 import { i as isJsonObject } from "./protocol-CANUwXJ3.mjs";
-import { m as sessionBindingIdentity } from "./session-binding-record-DU_0biMD.mjs";
-import { c as withMcpElicitationsApprovalPolicy, d as readCodexRequirementsToml, n as hasCodexMcpToolApprovalOverrides, s as shouldAutoApproveCodexAppServerApprovals } from "./config-security-clxAZYWX.mjs";
-import { c as isCodexPairedNodeRemoteExecPlacementSandbox, d as readCodexPluginConfig, l as isCodexRemoteExecPlacementSandbox, u as isCodexSandboxExecServerEnabled } from "./config-parsing-DsWSCPHO.mjs";
-import { i as resolveCodexAppServerHomeScope, l as resolveCodexModelBackedReviewerPolicyContext } from "./config-options-DDzeNQ8m.mjs";
+import { m as sessionBindingIdentity } from "./session-binding-record-C2kDBZhx.mjs";
+import { c as withMcpElicitationsApprovalPolicy, d as readCodexRequirementsToml, n as hasCodexMcpToolApprovalOverrides, s as shouldAutoApproveCodexAppServerApprovals } from "./config-security-D0hAOQRI.mjs";
+import { c as isCodexPairedNodeRemoteExecPlacementSandbox, d as readCodexPluginConfig, l as isCodexRemoteExecPlacementSandbox, u as isCodexSandboxExecServerEnabled } from "./config-parsing-CVK2Q463.mjs";
+import { i as resolveCodexAppServerHomeScope, l as resolveCodexModelBackedReviewerPolicyContext } from "./config-options-nvYwVDyy.mjs";
 import { n as formatCodexUsageLimitErrorMessage } from "./rate-limits-CI8pTPqL.mjs";
-import { i as resolveCodexBindingAppServerConnection, r as requireCodexSupervisionModelSelection } from "./binding-connection-B7HAAZSI.mjs";
-import { n as canUseCodexModelBackedApprovalsReviewerForModel, r as resolveOpenClawExecPolicyForCodexAppServer } from "./config-C1YVVLEA.mjs";
-import { Z as readRecentCodexRateLimits, b as withLeasedCodexAppServerClientStartSelectionRetry, c as getLeasedSharedCodexAppServerClient, m as releaseCodexAppServerClientLease, nt as resolveCodexAppServerPreparedAuthHandoff } from "./shared-client-CCz9ldpr.mjs";
-import { E as resolveDynamicToolCallTimeoutMs, O as toCodexDynamicToolProtocolResponse, T as handleDynamicToolCallWithTimeout, _ as assertCodexTurnStartResponse, a as isCodexAppServerIndeterminateRequestCancellationError, k as resolveCodexToolAbortTerminalReason, m as assertCodexThreadForkResponse, r as isCodexAppServerApprovalRequest, w as createCodexElicitationResponse, y as readCodexDynamicToolCallParams } from "./client-aPKNc4Ii.mjs";
-import { d as terminateCodexBackgroundTerminals, f as unsubscribeCodexThreadBestEffort, l as retireUnsafeCodexTurnClientBestEffort, s as interruptCodexTurnAndWaitBestEffort } from "./attempt-client-cleanup-D3YvP0N7.mjs";
-import { t as CodexEphemeralTurn } from "./ephemeral-turn-DAlEbytF.mjs";
-import { d as mergeCodexThreadConfigs, f as refreshCodexPluginAppApprovalPolicy } from "./project-doc-thread-config-BVcvnps8.mjs";
+import { i as resolveCodexBindingAppServerConnection, r as requireCodexSupervisionModelSelection } from "./binding-connection-X1ZeEDz8.mjs";
+import { n as canUseCodexModelBackedApprovalsReviewerForModel, r as resolveOpenClawExecPolicyForCodexAppServer } from "./config-G4IGX6bK.mjs";
+import { Z as readRecentCodexRateLimits, b as withLeasedCodexAppServerClientStartSelectionRetry, c as getLeasedSharedCodexAppServerClient, m as releaseCodexAppServerClientLease, nt as resolveCodexAppServerPreparedAuthHandoff } from "./shared-client-wb1JBldZ.mjs";
+import { E as resolveDynamicToolCallTimeoutMs, O as toCodexDynamicToolProtocolResponse, T as handleDynamicToolCallWithTimeout, _ as assertCodexTurnStartResponse, a as isCodexAppServerIndeterminateRequestCancellationError, k as resolveCodexToolAbortTerminalReason, m as assertCodexThreadForkResponse, r as isCodexAppServerApprovalRequest, w as createCodexElicitationResponse, y as readCodexDynamicToolCallParams } from "./client-BpSxNz4F.mjs";
+import { d as terminateCodexBackgroundTerminals, f as unsubscribeCodexThreadBestEffort, l as retireUnsafeCodexTurnClientBestEffort, s as interruptCodexTurnAndWaitBestEffort } from "./attempt-client-cleanup-TScCVTsk.mjs";
+import { t as CodexEphemeralTurn } from "./ephemeral-turn-C6aFeGFS.mjs";
+import { d as mergeCodexThreadConfigs, f as refreshCodexPluginAppApprovalPolicy } from "./project-doc-thread-config-B2ZD23A_.mjs";
 import { n as resolveCodexAppServerReasoningEffort, t as readCodexSupportedReasoningEfforts } from "./reasoning-effort-CS9kKWB9.mjs";
-import { h as resolveCodexWebSearchPlan, r as buildCodexRuntimeThreadConfig, z as resolveCodexDynamicToolsLoading } from "./thread-requests-BgzJwJtS.mjs";
-import { i as resolveCodexSessionBinding } from "./session-binding-JEHNMPsr.mjs";
+import { h as resolveCodexWebSearchPlan, r as buildCodexRuntimeThreadConfig, z as resolveCodexDynamicToolsLoading } from "./thread-requests-BqPhA4Gs.mjs";
+import { i as resolveCodexSessionBinding } from "./session-binding-BDnNz-Co.mjs";
 import { i as resolveCodexAppServerThreadModelSelection, t as CODEX_NATIVE_PERSONALITY_NONE } from "./thread-model-selection-DcVebr8N.mjs";
-import { t as resolveCodexNativeExecutionBlock } from "./sandbox-guard-DIImwCy1.mjs";
-import { i as assertCodexSupervisionThreadLineage, n as CodexThreadPolicyHandoffError, o as refreshCodexThreadPolicy } from "./thread-policy-CLTwg3ZA.mjs";
-import { o as runCodexCleanupStep } from "./run-attempt-lifecycle-KN4oh-7O.mjs";
-import { a as resolveCodexExternalSandboxPolicyForOpenClawSandbox, c as shouldEnableCodexAppServerNativeToolSurface, l as shouldRequireCodexSandboxExecServerEnvironment, o as resolveCodexMessageToolProvider, s as resolveCodexSandboxEnvironmentSelection, t as buildDynamicTools } from "./dynamic-tool-build-DKko0Jjw.mjs";
-import { a as buildCodexNativeHookRelayDisabledConfig, i as buildCodexNativeHookRelayConfig, l as resolveCodexNativeHookRelayEvents, u as resolveCodexNativeHookRelayTtlMs } from "./native-hook-relay-DQzvuJ-W.mjs";
-import { i as resolveCodexSessionPermissionCwd, n as applyCodexSessionPermissionPolicy, r as resolveCodexEffectiveSessionPermissionPolicy, t as CODEX_SESSION_PERMISSION_EXEC_MODES } from "./session-permission-policy-CD2MAWU8.mjs";
-import { a as handleCodexAppServerApprovalRequest, c as createCodexNativePreToolUseFailureBuffer, d as buildCodexTemporalAdditionalContext, g as buildCodexUserInput, i as createCodexDynamicToolDiagnostics, o as ensureCodexSandboxExecServerEnvironment, r as routeCodexAppServerElicitationRequest, s as releaseCodexSandboxExecServerEnvironment, t as createCodexDynamicToolBridge, y as CodexNativeToolLifecycleProjector } from "./dynamic-tools-8hqa1jVc.mjs";
-import { t as resolveCodexAppServerForModelProvider } from "./app-server-policy-D_zv8J7V.mjs";
-import { n as resolveCodexProviderWebSearchSupportForClient } from "./provider-capabilities-DWH29sy3.mjs";
+import { t as resolveCodexNativeExecutionBlock } from "./sandbox-guard-Cf9XMRrg.mjs";
+import { i as assertCodexSupervisionThreadLineage, n as CodexThreadPolicyHandoffError, o as refreshCodexThreadPolicy } from "./thread-policy-BMRvlOi-.mjs";
+import { o as runCodexCleanupStep } from "./run-attempt-lifecycle-DN-ATDp9.mjs";
+import { a as resolveCodexExternalSandboxPolicyForOpenClawSandbox, c as shouldEnableCodexAppServerNativeToolSurface, l as shouldRequireCodexSandboxExecServerEnvironment, o as resolveCodexMessageToolProvider, s as resolveCodexSandboxEnvironmentSelection, t as buildDynamicTools } from "./dynamic-tool-build-CoMf7IKx.mjs";
+import { a as buildCodexNativeHookRelayDisabledConfig, i as buildCodexNativeHookRelayConfig, l as resolveCodexNativeHookRelayEvents, u as resolveCodexNativeHookRelayTtlMs } from "./native-hook-relay-BQ9UkpeG.mjs";
+import { i as resolveCodexSessionPermissionCwd, n as applyCodexSessionPermissionPolicy, r as resolveCodexEffectiveSessionPermissionPolicy, t as CODEX_SESSION_PERMISSION_EXEC_MODES } from "./session-permission-policy-BYI6mp5u.mjs";
+import { a as handleCodexAppServerApprovalRequest, c as createCodexNativePreToolUseFailureBuffer, d as buildCodexTemporalAdditionalContext, g as buildCodexUserInput, i as createCodexDynamicToolDiagnostics, o as ensureCodexSandboxExecServerEnvironment, r as routeCodexAppServerElicitationRequest, s as releaseCodexSandboxExecServerEnvironment, t as createCodexDynamicToolBridge, y as CodexNativeToolLifecycleProjector } from "./dynamic-tools-CKynHtxM.mjs";
+import { t as resolveCodexAppServerForModelProvider } from "./app-server-policy-XTIa6h5k.mjs";
+import { n as resolveCodexProviderWebSearchSupportForClient } from "./provider-capabilities-DOBUBt86.mjs";
 import { readStringField } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { randomUUID } from "node:crypto";
 import { isDeepStrictEqual } from "node:util";

package/dist/.setup/{source-DsubBCYm.mjs → source-BjBw-zoV.mjs}

@@ -1,8 +1,8 @@
 import { a as defaultCodexAppInventoryCache, r as buildCodexPluginAppCacheKey } from "./plugin-app-cache-key-Bg9DbDI6.mjs";
-import { a as withCodexAppServerJsonClient } from "./request-DInueZ2q.mjs";
-import { a as marketplaceRef, o as pluginReadParams, r as isOpenAiCuratedMarketplaceName, u as CODEX_PLUGINS_MARKETPLACE_NAME } from "./plugin-inventory-CYgdo14P.mjs";
-import "./config-C1YVVLEA.mjs";
-import { t as __exportAll } from "./session-binding-sidecars-DD-enC8w.mjs";
+import { a as withCodexAppServerJsonClient } from "./request-DhbisYCc.mjs";
+import { a as marketplaceRef, o as pluginReadParams, r as isOpenAiCuratedMarketplaceName, u as CODEX_PLUGINS_MARKETPLACE_NAME } from "./plugin-inventory-kLR7G02h.mjs";
+import "./config-G4IGX6bK.mjs";
+import { t as __exportAll } from "./session-binding-sidecars-DijNZb31.mjs";
 import { asNonArrayRecord } from "openclaw/plugin-sdk/string-coerce-runtime";
 import path from "node:path";
 import os from "node:os";

package/dist/.setup/{thread-lifecycle-run-CxVfnkG-.mjs → thread-lifecycle-run-DdwKMIae.mjs}

@@ -1,11 +1,11 @@
 import { i as isJsonObject, r as flattenCodexDynamicToolFunctions } from "./protocol-CANUwXJ3.mjs";
-import { n as matchesPendingSupervisionBranch } from "./session-binding-record-codec-BpH8u_G9.mjs";
-import { m as sessionBindingIdentity, n as assertCodexBindingMayBeReplaced } from "./session-binding-record-DU_0biMD.mjs";
-import { l as fingerprintCodexPolicy } from "./config-security-clxAZYWX.mjs";
-import { f as resolveCodexPluginsPolicy } from "./config-parsing-DsWSCPHO.mjs";
+import { n as matchesPendingSupervisionBranch } from "./session-binding-record-codec-CWQXr9os.mjs";
+import { m as sessionBindingIdentity, n as assertCodexBindingMayBeReplaced } from "./session-binding-record-C2kDBZhx.mjs";
+import { l as fingerprintCodexPolicy } from "./config-security-D0hAOQRI.mjs";
+import { f as resolveCodexPluginsPolicy } from "./config-parsing-CVK2Q463.mjs";
 import { n as resolveCodexAppServerLocalHomeDir, t as resolveCodexAppServerHomeDir } from "./auth-start-options-BPIPeEX8.mjs";
-import { d as readCodexEffectiveConfig, s as assertCodexModelBackedReviewerEffectiveConfig, u as CODEX_SESSION_OVERRIDABLE_LAYER_TYPES } from "./config-options-DDzeNQ8m.mjs";
-import { S as retainSharedCodexAppServerClientByInstanceId, d as getCurrentSharedClientEntry } from "./auth-cache-key-BzYrcgwJ.mjs";
+import { d as readCodexEffectiveConfig, s as assertCodexModelBackedReviewerEffectiveConfig, u as CODEX_SESSION_OVERRIDABLE_LAYER_TYPES } from "./config-options-nvYwVDyy.mjs";
+import { S as retainSharedCodexAppServerClientByInstanceId, d as getCurrentSharedClientEntry } from "./auth-cache-key-DvDLHVJe.mjs";
 import { t as withCodexAppServerThreadMutation } from "./thread-ownership-queue-CeyYScUC.mjs";
 import { o as isCodexAppServerOverloadError, r as CodexAppServerRpcError, s as isCodexThreadReadMissingError } from "./rpc-error-C98SHchT.mjs";
 import { t as codexCatalogHomeId } from "./session-catalog-home-id-vlih0B_g.mjs";
@@ -13,27 +13,27 @@ import { r as withAbortableTimeout } from "./timeout-D0mEWSGG.mjs";
 import { t as projectBoundedCodexThreadHistory } from "./transcript-history-projection-DfKcoZCB.mjs";
 import { a as defaultCodexAppInventoryCache, t as buildCodexAppServerConnectionFingerprint } from "./plugin-app-cache-key-Bg9DbDI6.mjs";
 import { n as readCodexSessionMeta } from "./session-catalog-provenance-CmsOE5mh.mjs";
-import { t as assertCodexSessionRuntimeOwnership } from "./binding-connection-B7HAAZSI.mjs";
-import { c as resolveRecoverableCodexPluginConfigKeys } from "./plugin-inventory-CYgdo14P.mjs";
-import "./config-C1YVVLEA.mjs";
+import { t as assertCodexSessionRuntimeOwnership } from "./binding-connection-X1ZeEDz8.mjs";
+import { c as resolveRecoverableCodexPluginConfigKeys } from "./plugin-inventory-kLR7G02h.mjs";
+import "./config-G4IGX6bK.mjs";
 import { c as resolveCodexContextEngineProjectionMaxChars } from "./context-engine-projection-ps-yn_ci.mjs";
 import { n as normalizeCodexAppServerBindingModelProvider } from "./auth-profile-CgHQ8Vot.mjs";
-import { $ as createCodexEphemeralThreadPolicy, A as bindCodexInferenceThread, B as isCodexAppServerClientRuntimeLive, C as CodexThreadBindingConflictError, F as consumeCodexAppServerLiveThread, H as isCodexAppServerLiveThreadProtected, K as releaseCodexAppServerLiveThread, M as getCodexInferenceThreadQualification, N as prepareCodexInferenceThreadConfig, S as CodexAdoptedThreadActiveError, T as CodexThreadStartRequestError, V as isCodexAppServerLiveThreadClaimed, Y as unsubscribeCodexAppServerLiveThread, j as getCodexInferenceThread, k as assertCodexInferenceRouteConfig, n as captureCodexAppServerClientLifetime, w as CodexThreadClientReplacementError, z as hasCodexAppServerSiblingThreadWork } from "./shared-client-CCz9ldpr.mjs";
-import { C as resolveCodexThreadRolloutPath, F as getCodexAppServerClientInstanceId, L as resolveCodexAppServerClientInstanceId, S as readSupervisionResponseThreadId, c as isCodexAppServerRequestTimeoutError, g as assertCodexThreadStartResponse, m as assertCodexThreadForkResponse, p as assertCodexThreadAcceptsDirectInput, v as assertExactSupervisionModelSelection } from "./client-aPKNc4Ii.mjs";
-import { r as hasCodexAppServerSiblingRouteWork } from "./turn-router-CSJl3yYQ.mjs";
-import { f as unsubscribeCodexThreadBestEffort, l as retireUnsafeCodexTurnClientBestEffort, n as CODEX_APP_SERVER_UNSUBSCRIBE_TIMEOUT_MS, o as closeCodexStartupClientBestEffort, r as CodexAppServerUnsafeSubscriptionError } from "./attempt-client-cleanup-D3YvP0N7.mjs";
-import { a as buildCodexPluginThreadConfigInputFingerprint, c as buildPluginAppPolicyContext, d as mergeCodexThreadConfigs, i as buildCodexPluginThreadConfig, l as disableUnlistedCodexApps, m as buildCodexAppApprovalOverrides, n as mergeCodexNativeProjectDocThreadConfig, o as buildCodexPluginThreadConfigTimeoutFallback, p as shouldBuildCodexPluginThreadConfig, r as buildCodexPluginAppsConfigPatchFromPolicyContext, u as isCodexPluginThreadBindingStale } from "./project-doc-thread-config-BVcvnps8.mjs";
-import { A as isTransientWebSearchRestriction, C as fingerprintEnvironmentSelection, D as readActiveCodexTurnIdsFromResume, E as legacyFingerprintUserMcpServersConfigPatch, I as isMessageOnlyCodexSourceReply, L as isSystemAgentOnlyCodexDynamicToolAllowlist, M as shouldRotateCodexAppServerBindingForRuntime, N as shouldRotateCodexGpt56MultiAgentBinding, O as shouldStartTransientNoToolThread, S as fingerprintCodexThreadConfig, T as fingerprintUserMcpServersConfigPatch, _ as buildDeveloperInstructions, b as codexDynamicToolsFingerprint, c as codexThreadSandboxOrPermissions, d as readCodexManagedRequirementsFingerprint, f as resolveCodexThreadApprovalsReviewer, g as mergeCodexNativeShellEnvironment, h as resolveCodexWebSearchPlan, i as buildCodexRuntimeThreadConfigForRun, j as shouldRecheckRecoverablePluginBinding, n as buildCodexRingZeroThreadConfigPatch, o as buildThreadResumeParams, p as attestCodexRestrictedToolSurfaceMcpServersDisabled, s as buildThreadStartParams, t as assertCodexManagedRequirementsDoNotOverrideToolPolicy, u as readCodexInheritedMcpServerNames, v as areCodexDynamicToolFingerprintsCompatible, w as fingerprintJsonObject, x as codexLegacyDynamicToolsFingerprint, y as areUserMcpServersFingerprintsCompatible } from "./thread-requests-BgzJwJtS.mjs";
-import { i as resolveCodexSessionBinding, o as hashCodexAppServerBindingFingerprint } from "./session-binding-JEHNMPsr.mjs";
+import { $ as createCodexEphemeralThreadPolicy, A as bindCodexInferenceThread, B as isCodexAppServerClientRuntimeLive, C as CodexThreadBindingConflictError, F as consumeCodexAppServerLiveThread, H as isCodexAppServerLiveThreadProtected, K as releaseCodexAppServerLiveThread, M as getCodexInferenceThreadQualification, N as prepareCodexInferenceThreadConfig, S as CodexAdoptedThreadActiveError, T as CodexThreadStartRequestError, V as isCodexAppServerLiveThreadClaimed, Y as unsubscribeCodexAppServerLiveThread, j as getCodexInferenceThread, k as assertCodexInferenceRouteConfig, n as captureCodexAppServerClientLifetime, w as CodexThreadClientReplacementError, z as hasCodexAppServerSiblingThreadWork } from "./shared-client-wb1JBldZ.mjs";
+import { C as resolveCodexThreadRolloutPath, F as getCodexAppServerClientInstanceId, L as resolveCodexAppServerClientInstanceId, S as readSupervisionResponseThreadId, c as isCodexAppServerRequestTimeoutError, g as assertCodexThreadStartResponse, m as assertCodexThreadForkResponse, p as assertCodexThreadAcceptsDirectInput, v as assertExactSupervisionModelSelection } from "./client-BpSxNz4F.mjs";
+import { r as hasCodexAppServerSiblingRouteWork } from "./turn-router-DdlzuFdm.mjs";
+import { f as unsubscribeCodexThreadBestEffort, l as retireUnsafeCodexTurnClientBestEffort, n as CODEX_APP_SERVER_UNSUBSCRIBE_TIMEOUT_MS, o as closeCodexStartupClientBestEffort, r as CodexAppServerUnsafeSubscriptionError } from "./attempt-client-cleanup-TScCVTsk.mjs";
+import { a as buildCodexPluginThreadConfigInputFingerprint, c as buildPluginAppPolicyContext, d as mergeCodexThreadConfigs, i as buildCodexPluginThreadConfig, l as disableUnlistedCodexApps, m as buildCodexAppApprovalOverrides, n as mergeCodexNativeProjectDocThreadConfig, o as buildCodexPluginThreadConfigTimeoutFallback, p as shouldBuildCodexPluginThreadConfig, r as buildCodexPluginAppsConfigPatchFromPolicyContext, u as isCodexPluginThreadBindingStale } from "./project-doc-thread-config-B2ZD23A_.mjs";
+import { A as isTransientWebSearchRestriction, C as fingerprintEnvironmentSelection, D as readActiveCodexTurnIdsFromResume, E as legacyFingerprintUserMcpServersConfigPatch, I as isMessageOnlyCodexSourceReply, L as isSystemAgentOnlyCodexDynamicToolAllowlist, M as shouldRotateCodexAppServerBindingForRuntime, N as shouldRotateCodexGpt56MultiAgentBinding, O as shouldStartTransientNoToolThread, S as fingerprintCodexThreadConfig, T as fingerprintUserMcpServersConfigPatch, _ as buildDeveloperInstructions, b as codexDynamicToolsFingerprint, c as codexThreadSandboxOrPermissions, d as readCodexManagedRequirementsFingerprint, f as resolveCodexThreadApprovalsReviewer, g as mergeCodexNativeShellEnvironment, h as resolveCodexWebSearchPlan, i as buildCodexRuntimeThreadConfigForRun, j as shouldRecheckRecoverablePluginBinding, n as buildCodexRingZeroThreadConfigPatch, o as buildThreadResumeParams, p as attestCodexRestrictedToolSurfaceMcpServersDisabled, s as buildThreadStartParams, t as assertCodexManagedRequirementsDoNotOverrideToolPolicy, u as readCodexInheritedMcpServerNames, v as areCodexDynamicToolFingerprintsCompatible, w as fingerprintJsonObject, x as codexLegacyDynamicToolsFingerprint, y as areUserMcpServersFingerprintsCompatible } from "./thread-requests-BqPhA4Gs.mjs";
+import { i as resolveCodexSessionBinding, o as hashCodexAppServerBindingFingerprint } from "./session-binding-BDnNz-Co.mjs";
 import { i as resolveCodexAppServerThreadModelSelection, n as resolveCodexAppServerModelProvider } from "./thread-model-selection-DcVebr8N.mjs";
-import { c as withExclusiveCodexAppServerThread, r as retainCodexAppServerBindingSubscription, t as isSameCodexAppServerThreadOwner } from "./thread-ownership-_2e1sjfi.mjs";
-import { a as refreshCodexThreadInstructions, i as assertCodexSupervisionThreadLineage, n as CodexThreadPolicyHandoffError, o as refreshCodexThreadPolicy, r as assertAdoptedCodexThreadResumeAllowed, t as CodexIncognitoPolicyChangeError } from "./thread-policy-CLTwg3ZA.mjs";
-import { t as resumeCodexAppServerThread } from "./thread-resume-C6qsk8_o.mjs";
-import { r as readCodexMcpToolConnectorId } from "./mcp-tool-metadata-DW41snf3.mjs";
-import { n as disableCodexPluginThreadConfig } from "./dynamic-tool-build-DKko0Jjw.mjs";
-import { n as CodexManagedHooksOnlyError, r as assertCodexNativeHookRelayAllowed } from "./native-hook-relay-DQzvuJ-W.mjs";
+import { c as withExclusiveCodexAppServerThread, r as retainCodexAppServerBindingSubscription, t as isSameCodexAppServerThreadOwner } from "./thread-ownership-CTUs8Eyu.mjs";
+import { a as refreshCodexThreadInstructions, i as assertCodexSupervisionThreadLineage, n as CodexThreadPolicyHandoffError, o as refreshCodexThreadPolicy, r as assertAdoptedCodexThreadResumeAllowed, t as CodexIncognitoPolicyChangeError } from "./thread-policy-BMRvlOi-.mjs";
+import { t as resumeCodexAppServerThread } from "./thread-resume-CD48Vab8.mjs";
+import { r as readCodexMcpToolConnectorId } from "./mcp-tool-metadata-_sawBkIh.mjs";
+import { n as disableCodexPluginThreadConfig } from "./dynamic-tool-build-CoMf7IKx.mjs";
+import { n as CodexManagedHooksOnlyError, r as assertCodexNativeHookRelayAllowed } from "./native-hook-relay-BQ9UkpeG.mjs";
 import { t as defaultCodexPluginMetadataCache } from "./plugin-metadata-cache-Bi8TAPwX.mjs";
-import { a as discardUnattestedCodexPluginThread, i as checkCodexThreadAppAvailability, n as resolveCodexNativeSkillIsolation, o as hasCodexNativeToolCatalog, r as attestCodexThreadToolSurface, s as loadCodexNativeToolCatalog, t as applyCodexNativeSkillIsolation } from "./native-skill-isolation-DoRxgQPX.mjs";
+import { a as discardUnattestedCodexPluginThread, i as checkCodexThreadAppAvailability, n as resolveCodexNativeSkillIsolation, o as hasCodexNativeToolCatalog, r as attestCodexThreadToolSurface, s as loadCodexNativeToolCatalog, t as applyCodexNativeSkillIsolation } from "./native-skill-isolation-CxZRtiWZ.mjs";
 import { asOptionalRecord, normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
 import crypto from "node:crypto";
 import { isDeepStrictEqual } from "node:util";
@@ -825,7 +825,7 @@ async function prepareCodexThreadLifecyclePreflight(params) {
 	if (restrictedToolSurface && params.nativeCodeModeEnabled !== false) throw new Error("Codex restricted tool surfaces require native code mode to be disabled");
 	if (!effectiveConfig) effectiveConfig = await lifecycleTiming.measure("effective-config-read", () => readCodexEffectiveConfig(params.client, params.cwd, { signal: params.signal }));
 	params.config = mergeCodexNativeProjectDocThreadConfig(params.config, effectiveConfig);
-	if (params.shellEnvironment || params.shellGitConfigParameters) params.config = mergeCodexNativeShellEnvironment(params.config, effectiveConfig.config.shell_environment_policy);
+	if (params.shellEnvironment) params.config = mergeCodexNativeShellEnvironment(params.config, effectiveConfig.config.shell_environment_policy);
 	const restrictedToolSurfaceInheritedMcpServerNames = restrictedToolSurface ? await lifecycleTiming.measure("restricted-tool-surface-mcp-policy", () => readCodexInheritedMcpServerNames(params.client, params.cwd, params.signal, effectiveConfig)) : [];
 	if (restrictedToolSurface || imageGenerationDenied || params.nativeCodeModeEnabled !== false) await lifecycleTiming.measure("tool-policy-config-requirements-read", () => assertCodexManagedRequirementsDoNotOverrideToolPolicy(params.client, {
 		restrictedToolSurface,

package/dist/.setup/{thread-ownership-_2e1sjfi.mjs → thread-ownership-CTUs8Eyu.mjs}

@@ -1,8 +1,8 @@
-import { S as retainSharedCodexAppServerClientByInstanceId } from "./auth-cache-key-BzYrcgwJ.mjs";
+import { S as retainSharedCodexAppServerClientByInstanceId } from "./auth-cache-key-DvDLHVJe.mjs";
 import { t as withCodexAppServerThreadMutation } from "./thread-ownership-queue-CeyYScUC.mjs";
-import { K as releaseCodexAppServerLiveThread, V as isCodexAppServerLiveThreadClaimed, q as retainCodexAppServerLiveThread } from "./shared-client-CCz9ldpr.mjs";
-import { f as unsubscribeCodexThreadBestEffort, o as closeCodexStartupClientBestEffort, r as CodexAppServerUnsafeSubscriptionError } from "./attempt-client-cleanup-D3YvP0N7.mjs";
-import { t as __exportAll } from "./session-binding-sidecars-DD-enC8w.mjs";
+import { K as releaseCodexAppServerLiveThread, V as isCodexAppServerLiveThreadClaimed, q as retainCodexAppServerLiveThread } from "./shared-client-wb1JBldZ.mjs";
+import { f as unsubscribeCodexThreadBestEffort, o as closeCodexStartupClientBestEffort, r as CodexAppServerUnsafeSubscriptionError } from "./attempt-client-cleanup-TScCVTsk.mjs";
+import { t as __exportAll } from "./session-binding-sidecars-DijNZb31.mjs";
 import { createDeferred } from "openclaw/plugin-sdk/extension-shared";
 import { runWithAsyncWorkResources } from "openclaw/plugin-sdk/agent-harness-tool-runtime";
 //#region extensions/codex/src/app-server/thread-ownership.ts

package/dist/.setup/{thread-policy-CLTwg3ZA.mjs → thread-policy-BMRvlOi-.mjs}

@@ -1,7 +1,7 @@
 import { i as CodexAppServerScopedRequestRejectedError, o as isCodexAppServerOverloadError } from "./rpc-error-C98SHchT.mjs";
-import { n as requestCodexAppServerClientJson } from "./request-DInueZ2q.mjs";
-import { S as CodexAdoptedThreadActiveError } from "./shared-client-CCz9ldpr.mjs";
-import { p as assertCodexThreadAcceptsDirectInput, s as isCodexAppServerPrewriteRequestCancellationError } from "./client-aPKNc4Ii.mjs";
+import { n as requestCodexAppServerClientJson } from "./request-DhbisYCc.mjs";
+import { S as CodexAdoptedThreadActiveError } from "./shared-client-wb1JBldZ.mjs";
+import { p as assertCodexThreadAcceptsDirectInput, s as isCodexAppServerPrewriteRequestCancellationError } from "./client-BpSxNz4F.mjs";
 import { AgentHarnessPreflightError, embeddedAgentLog, formatErrorMessage } from "openclaw/plugin-sdk/agent-harness-runtime";
 //#region extensions/codex/src/app-server/thread-policy.ts
 /** A refusal, not a failed native write: the ephemeral conversation must stay alive. */

package/dist/.setup/{thread-requests-BgzJwJtS.mjs → thread-requests-BqPhA4Gs.mjs}

@@ -1,13 +1,11 @@
 import { i as isJsonObject } from "./protocol-CANUwXJ3.mjs";
-import { t as appendCodexGitConfigParameters } from "./config-utils-DN_YT7dE.mjs";
-import { d as readCodexEffectiveConfig, u as CODEX_SESSION_OVERRIDABLE_LAYER_TYPES } from "./config-options-DDzeNQ8m.mjs";
+import { d as readCodexEffectiveConfig, u as CODEX_SESSION_OVERRIDABLE_LAYER_TYPES } from "./config-options-nvYwVDyy.mjs";
 import { a as isCodexResponsesOAuthRun } from "./responses-oauth-twnuTaAa.mjs";
-import { d as mergeCodexThreadConfigs, t as buildCodexProjectDocThreadConfig } from "./project-doc-thread-config-BVcvnps8.mjs";
-import { o as hashCodexAppServerBindingFingerprint } from "./session-binding-JEHNMPsr.mjs";
+import { d as mergeCodexThreadConfigs, t as buildCodexProjectDocThreadConfig } from "./project-doc-thread-config-B2ZD23A_.mjs";
+import { o as hashCodexAppServerBindingFingerprint } from "./session-binding-BDnNz-Co.mjs";
 import { n as resolveCodexAppServerModelProvider, r as resolveCodexAppServerRequestModelSelection, t as CODEX_NATIVE_PERSONALITY_NONE } from "./thread-model-selection-DcVebr8N.mjs";
 import { normalizeOptionalString, normalizeUniqueStringEntries, normalizeUniqueTrimmedStringList } from "openclaw/plugin-sdk/string-coerce-runtime";
-import * as crypto$1 from "node:crypto";
-import crypto from "node:crypto";
+import crypto, * as crypto$1 from "node:crypto";
 import path from "node:path";
 import { isIncognitoSessionKey } from "openclaw/plugin-sdk/session-key-runtime";
 import { expectDefined } from "openclaw/plugin-sdk/expect-runtime";
@@ -278,41 +276,20 @@ function buildDeveloperInstructions(params, options = {}) {
 }
 //#endregion
 //#region extensions/codex/src/app-server/thread-shell-environment.ts
-const GIT_CONFIG_PARAMETERS = "GIT_CONFIG_PARAMETERS";
-function matchesGitConfigParameters(pattern) {
-	const escaped = pattern.replace(/[.+^${}()|[\]\\]/gu, "\\$&");
-	return new RegExp(`^${escaped.replaceAll("*", ".*").replaceAll("?", ".")}$`, "iu").test(GIT_CONFIG_PARAMETERS);
-}
 /** Retain native policy beneath request overrides before applying host-owned values. */
 function mergeCodexNativeShellEnvironment(config, nativePolicy) {
 	return isJsonObject(nativePolicy) ? mergeCodexThreadConfigs({ shell_environment_policy: Object.fromEntries(Object.entries(nativePolicy).filter(([, value]) => value !== null)) }, config) : config;
 }
 /** Applies host-selected values and any required login-shell restriction last. */
-function applyCodexManagedShellEnvironment(config, environment, disableLoginShell = false, pathPrepend, gitConfigParameters) {
-	const hasEnvironment = environment !== void 0 && Object.keys(environment).length > 0;
-	if (!hasEnvironment && !gitConfigParameters) return disableLoginShell ? {
+function applyCodexManagedShellEnvironment(config, environment, disableLoginShell = false, pathPrepend) {
+	if (!environment || Object.keys(environment).length === 0) return disableLoginShell ? {
 		...config,
 		allow_login_shell: false
 	} : config;
 	const current = isJsonObject(config.shell_environment_policy) ? config.shell_environment_policy : {};
 	const currentSet = isJsonObject(current.set) ? current.set : {};
 	const managedEnvironment = { ...environment };
-	const includeOnly = Array.isArray(current.include_only) ? current.include_only.filter((entry) => typeof entry === "string") : [];
-	const filters = isJsonObject(current.filters) ? current.filters : void 0;
-	if (gitConfigParameters) {
-		const include = filters ? Object.keys(filters).filter((pattern) => filters[pattern] === "include") : includeOnly;
-		const exclude = filters ? Object.keys(filters).filter((pattern) => filters[pattern] === "exclude") : Array.isArray(current.exclude) ? current.exclude.filter((entry) => typeof entry === "string") : [];
-		const aliases = Object.keys(currentSet).filter((key) => key === GIT_CONFIG_PARAMETERS || process.platform === "win32" && key.toUpperCase() === GIT_CONFIG_PARAMETERS);
-		const authoredKey = aliases.includes(GIT_CONFIG_PARAMETERS) ? GIT_CONFIG_PARAMETERS : aliases[0];
-		const includesParameters = include.length === 0 || include.some(matchesGitConfigParameters);
-		const inheritsParameters = current.inherit !== "none" && current.inherit !== "core" && !exclude.some(matchesGitConfigParameters) && includesParameters;
-		if (authoredKey !== void 0 || !inheritsParameters) {
-			const base = authoredKey !== void 0 && includesParameters ? currentSet[authoredKey] : void 0;
-			const composed = appendCodexGitConfigParameters(typeof base === "string" ? base : void 0, gitConfigParameters);
-			for (const name of [GIT_CONFIG_PARAMETERS, ...aliases]) managedEnvironment[name] = composed;
-		}
-	}
-	if (pathPrepend?.length) for (const key of Object.keys(environment ?? {})) {
+	if (pathPrepend?.length) for (const key of Object.keys(environment)) {
 		if (key.toUpperCase() !== "PATH") continue;
 		const aliases = Object.keys(currentSet).filter((name) => name === key || process.platform === "win32" && name.toUpperCase() === "PATH");
 		const authoredKey = aliases.includes(key) ? key : aliases[0];
@@ -322,13 +299,15 @@ function applyCodexManagedShellEnvironment(config, environment, disableLoginShel
 		}
 	}
 	const names = Object.keys(managedEnvironment).toSorted();
+	const includeOnly = Array.isArray(current.include_only) ? current.include_only.filter((entry) => typeof entry === "string") : [];
+	const filters = isJsonObject(current.filters) ? current.filters : void 0;
 	const hasIncludeFilter = filters && Object.values(filters).includes("include");
 	const managedFilterNames = new Set(names.map((name) => name.toLowerCase()));
 	const managedConfig = {
 		...config,
 		shell_environment_policy: {
 			...current,
-			...hasEnvironment ? { experimental_use_profile: false } : {},
+			experimental_use_profile: false,
 			set: {
 				...currentSet,
 				...managedEnvironment
@@ -635,7 +614,7 @@ function buildCodexRuntimeThreadConfigForRun(params, config, options = {}) {
 			"skills.bundled.enabled": false
 		} : void 0, params.pluginHarnessToolPolicySafeDeniedTools?.includes("image_generate") ? { "features.image_generation": false } : void 0, shouldDisableCodexToolSearchForModel(params.modelId) ? { "features.multi_agent": false } : void 0, messageOnlySourceReply || params.pluginHarnessToolPolicyRestricted === true || params.requireWorkspaceOnly === true ? buildRestrictedToolConfigPatch(restrictedToolSurfaceMcpServerNames, Boolean(params.scheduledRuntimeAuthority) && !isCodexResponsesOAuthRun(params) && params.requireWorkspaceOnly !== true) : buildCodexRingZeroThreadConfigPatch(params, options.hostSystemAgentActive, restrictedToolSurfaceMcpServerNames), restrictedTurnDisablesProjectDocs ? CODEX_NO_PROJECT_DOCS_CONFIG : void 0, params.authoredContextTokenCap === void 0 ? void 0 : { model_context_window: params.authoredContextTokenCap }) ?? baseConfig,
 		...params.bootstrapContextMode === "lightweight" ? CODEX_NO_PROJECT_DOCS_CONFIG : {}
-	}, options.shellEnvironment, options.disableLoginShell, options.shellPathPrepend, options.shellGitConfigParameters);
+	}, options.shellEnvironment, options.disableLoginShell, options.shellPathPrepend);
 }
 function buildCodexRingZeroThreadConfigPatch(params, hostSystemAgentActive = isHostScopedAgentToolActive("openclaw"), inheritedMcpServerNames = []) {
 	if (!hostSystemAgentActive || !isSystemAgentOnlyCodexDynamicToolAllowlist(params.toolsAllow)) return;

package/dist/.setup/{thread-resume-C6qsk8_o.mjs → thread-resume-CD48Vab8.mjs}

@@ -1,8 +1,8 @@
 import { i as CodexAppServerScopedRequestRejectedError, o as isCodexAppServerOverloadError, r as CodexAppServerRpcError } from "./rpc-error-C98SHchT.mjs";
-import { r as publishCodexCatalogResume } from "./session-catalog-events-DujfzcAY.mjs";
-import { L as forgetCodexWorkspaceReferences, pt as isCodexAppServerStartupError, u as isCodexAppServerStartSelectionChangedError } from "./shared-client-CCz9ldpr.mjs";
-import { h as assertCodexThreadResumeResponse, s as isCodexAppServerPrewriteRequestCancellationError } from "./client-aPKNc4Ii.mjs";
-import { f as unsubscribeCodexThreadBestEffort, i as assertCodexThreadResumeSubscription, r as CodexAppServerUnsafeSubscriptionError } from "./attempt-client-cleanup-D3YvP0N7.mjs";
+import { r as publishCodexCatalogResume } from "./session-catalog-events-IoszcO7-.mjs";
+import { L as forgetCodexWorkspaceReferences, pt as isCodexAppServerStartupError, u as isCodexAppServerStartSelectionChangedError } from "./shared-client-wb1JBldZ.mjs";
+import { h as assertCodexThreadResumeResponse, s as isCodexAppServerPrewriteRequestCancellationError } from "./client-BpSxNz4F.mjs";
+import { f as unsubscribeCodexThreadBestEffort, i as assertCodexThreadResumeSubscription, r as CodexAppServerUnsafeSubscriptionError } from "./attempt-client-cleanup-TScCVTsk.mjs";
 import { sanitizeTerminalText } from "openclaw/plugin-sdk/text-chunking";
 //#region extensions/codex/src/app-server/thread-resume.ts
 /** Owns Codex thread/resume subscription safety. */

package/dist/.setup/{transcript-mirror-Bee2o6jj.mjs → transcript-mirror-DVEzdOs0.mjs}

@@ -2,7 +2,7 @@ import { t as readCodexAsyncQuestions } from "./async-questions-DdhOCwGi.mjs";
 import { a as readUpstreamUserText, i as readMirrorIdentity, n as attachCodexMirrorIdentity, o as takeCodexAssistantItemIds, r as attachUpstreamUserText } from "./upstream-prompt-provenance-Ccd9MFRJ.mjs";
 import { t as projectBoundedCodexThreadHistory } from "./transcript-history-projection-DfKcoZCB.mjs";
 import { a as buildCodexMirrorIdempotencyKey, c as isMirroredAgentMessage, i as buildCodexMirrorDedupeIdentity, l as readCodexMirrorSourceFingerprint, n as attachCodexMirrorAttestation, o as fingerprintCodexMirrorSourceMessage, r as attachCodexMirrorRunId, t as applyCodexTranscriptTaint } from "./transcript-mirror-attestation-BzUXnrvv.mjs";
-import { t as __exportAll } from "./session-binding-sidecars-DD-enC8w.mjs";
+import { t as __exportAll } from "./session-binding-sidecars-DijNZb31.mjs";
 import { normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { deliverAgentHarnessUserInputPrompt, embeddedAgentLog, formatErrorMessage, projectAgentHarnessTranscriptMessageForDisplay, restorePreparedUserTurnOperationalMetaForRuntime, runAgentHarnessBeforeMessageWriteHook } from "openclaw/plugin-sdk/agent-harness-runtime";
 import { withCodexSessionTranscriptMirrorWrite } from "openclaw/plugin-sdk/codex-session-transcript-runtime";

package/dist/.setup/{transport-stdio-CRWTkKOn.mjs → transport-stdio-lgeKKHyw.mjs}

@@ -1,6 +1,5 @@
-import { t as appendCodexGitConfigParameters } from "./config-utils-DN_YT7dE.mjs";
 import { r as normalizeCodexAppServerArgs } from "./launch-args-DbFCehO7.mjs";
-import { i as resolveManagedCodexNativeCommand } from "./managed-binary-BtIjV7yN.mjs";
+import { i as resolveManagedCodexNativeCommand } from "./managed-binary-DwC9wxch.mjs";
 import { i as recordCodexAppServerSpawnFailure, r as getCodexAppServerSpawnFailure } from "./spawn-error-CL3n6MAa.mjs";
 import { createHash, randomUUID } from "node:crypto";
 import { stripVTControlCharacters } from "node:util";
@@ -864,20 +863,6 @@ function resolveCodexAppServerSpawnEnv(options, baseEnv = process.env, platform
 	}
 	return env;
 }
-/** Keep inherited Git settings in the private process environment, outside thread config. */
-function withCodexAppServerGitConfig(options, parameters) {
-	const env = resolveCodexAppServerSpawnEnv(options);
-	const key = process.platform === "win32" ? Object.keys(env).toSorted().find((name) => name.toUpperCase() === "GIT_CONFIG_PARAMETERS") : "GIT_CONFIG_PARAMETERS";
-	const inherited = key === void 0 ? void 0 : env[key];
-	return {
-		...options,
-		env: {
-			...options.env,
-			GIT_CONFIG_PARAMETERS: appendCodexGitConfigParameters(inherited, parameters)
-		},
-		...options.clearEnv ? { clearEnv: options.clearEnv.filter((name) => (process.platform === "win32" ? name.trim().toUpperCase() : name.trim()) !== "GIT_CONFIG_PARAMETERS") } : {}
-	};
-}
 /** Spawns the Codex app-server process and returns the shared transport interface. */
 async function createStdioTransport(options, baseEnv = process.env, assertCurrent, onSpawn) {
 	const isHostedGateway = baseEnv.OPENCLAW_GATEWAY_HOST_LIFELINE?.trim() === "stdin";
@@ -932,4 +917,4 @@ async function createStdioTransport(options, baseEnv = process.env, assertCurren
 	}
 }
 //#endregion
-export { closeCodexAppServerTransport as a, createCodexAppServerProcessReaperService as c, withCodexAppServerGitConfig as i, getCodexAppServerRegisteredTransportIdentity as l, resolveCodexAppServerSpawnEnv as n, closeCodexAppServerTransportAndWait as o, resolveCodexAppServerSpawnInvocation as r, hasCodexAppServerNaturalExit as s, createStdioTransport as t };
+export { closeCodexAppServerTransportAndWait as a, getCodexAppServerRegisteredTransportIdentity as c, closeCodexAppServerTransport as i, resolveCodexAppServerSpawnEnv as n, hasCodexAppServerNaturalExit as o, resolveCodexAppServerSpawnInvocation as r, createCodexAppServerProcessReaperService as s, createStdioTransport as t };

package/dist/.setup/{transport-websocket-DIyPfkHo.mjs → transport-websocket-DOY0dJXN.mjs}

@@ -1,5 +1,5 @@
 import { r as resolveCodexAppServerUserHomeDir } from "./auth-start-options-BPIPeEX8.mjs";
-import "./config-C1YVVLEA.mjs";
+import "./config-G4IGX6bK.mjs";
 import { t as codexWebSocketDataToBuffer } from "./websocket-data-XlRvt8Ys.mjs";
 import path from "node:path";
 import { EventEmitter } from "node:events";

package/dist/.setup/{turn-router-CSJl3yYQ.mjs → turn-router-DdlzuFdm.mjs}

@@ -1,6 +1,6 @@
 import { i as isJsonObject } from "./protocol-CANUwXJ3.mjs";
 import { n as waitForPromiseOrAbort, t as abortReason } from "./timeout-D0mEWSGG.mjs";
-import { x as readCodexTurnCompletedNotification } from "./client-aPKNc4Ii.mjs";
+import { x as readCodexTurnCompletedNotification } from "./client-BpSxNz4F.mjs";
 import { normalizeOptionalString, readStringField } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { AsyncResource } from "node:async_hooks";
 import { createDeferred } from "openclaw/plugin-sdk/extension-shared";

package/dist/.setup/{upstream-session-fork-BC45E4Pe.mjs → upstream-session-fork-BF0c69x6.mjs}

@@ -1,7 +1,7 @@
 import { i as isJsonObject, r as flattenCodexDynamicToolFunctions } from "./protocol-CANUwXJ3.mjs";
-import { m as sessionBindingIdentity } from "./session-binding-record-DU_0biMD.mjs";
-import { d as readCodexPluginConfig } from "./config-parsing-DsWSCPHO.mjs";
-import { s as assertCodexModelBackedReviewerEffectiveConfig } from "./config-options-DDzeNQ8m.mjs";
+import { m as sessionBindingIdentity } from "./session-binding-record-C2kDBZhx.mjs";
+import { d as readCodexPluginConfig } from "./config-parsing-CVK2Q463.mjs";
+import { s as assertCodexModelBackedReviewerEffectiveConfig } from "./config-options-nvYwVDyy.mjs";
 import { t as withCodexAppServerThreadMutation } from "./thread-ownership-queue-CeyYScUC.mjs";
 import { i as CodexAppServerScopedRequestRejectedError, o as isCodexAppServerOverloadError } from "./rpc-error-C98SHchT.mjs";
 import { a as readUpstreamUserText, i as readMirrorIdentity } from "./upstream-prompt-provenance-Ccd9MFRJ.mjs";
@@ -9,24 +9,24 @@ import { r as projectCodexUserItemText } from "./transcript-history-projection-D
 import { n as codexUpstreamBaseline, t as codexLastTerminalTurnId } from "./session-upstream-marker-D15C9NHp.mjs";
 import { r as buildCodexPluginAppCacheKey } from "./plugin-app-cache-key-Bg9DbDI6.mjs";
 import { n as readCodexSessionMeta } from "./session-catalog-provenance-CmsOE5mh.mjs";
-import "./request-DInueZ2q.mjs";
-import { r as resolveOpenClawExecPolicyForCodexAppServer } from "./config-C1YVVLEA.mjs";
-import { r as resolveCodexSupervisionAppServerRuntimeOptions } from "./config-runtime-DWzK-k0n.mjs";
+import "./request-DhbisYCc.mjs";
+import { r as resolveOpenClawExecPolicyForCodexAppServer } from "./config-G4IGX6bK.mjs";
+import { r as resolveCodexSupervisionAppServerRuntimeOptions } from "./config-runtime-B8agjie6.mjs";
 import { l as readCodexMirrorSourceFingerprint, o as fingerprintCodexMirrorSourceMessage } from "./transcript-mirror-attestation-BzUXnrvv.mjs";
-import { P as claimCodexAppServerLiveThread, R as hasCodexAppServerLiveThread, f as readCodexAppServerClientDesktopGenerationFingerprint } from "./shared-client-CCz9ldpr.mjs";
-import { m as assertCodexThreadForkResponse, p as assertCodexThreadAcceptsDirectInput, s as isCodexAppServerPrewriteRequestCancellationError } from "./client-aPKNc4Ii.mjs";
-import { d as mergeCodexThreadConfigs, i as buildCodexPluginThreadConfig, p as shouldBuildCodexPluginThreadConfig } from "./project-doc-thread-config-BVcvnps8.mjs";
-import { T as fingerprintUserMcpServersConfigPatch, _ as buildDeveloperInstructions, a as buildCodexThreadConfiguration, b as codexDynamicToolsFingerprint, h as resolveCodexWebSearchPlan, w as fingerprintJsonObject } from "./thread-requests-BgzJwJtS.mjs";
-import "./session-binding-JEHNMPsr.mjs";
-import "./thread-ownership-_2e1sjfi.mjs";
+import { P as claimCodexAppServerLiveThread, R as hasCodexAppServerLiveThread, f as readCodexAppServerClientDesktopGenerationFingerprint } from "./shared-client-wb1JBldZ.mjs";
+import { m as assertCodexThreadForkResponse, p as assertCodexThreadAcceptsDirectInput, s as isCodexAppServerPrewriteRequestCancellationError } from "./client-BpSxNz4F.mjs";
+import { d as mergeCodexThreadConfigs, i as buildCodexPluginThreadConfig, p as shouldBuildCodexPluginThreadConfig } from "./project-doc-thread-config-B2ZD23A_.mjs";
+import { T as fingerprintUserMcpServersConfigPatch, _ as buildDeveloperInstructions, a as buildCodexThreadConfiguration, b as codexDynamicToolsFingerprint, h as resolveCodexWebSearchPlan, w as fingerprintJsonObject } from "./thread-requests-BqPhA4Gs.mjs";
+import "./session-binding-BDnNz-Co.mjs";
+import "./thread-ownership-CTUs8Eyu.mjs";
 import { n as resolveCodexNativeExecutionPolicy } from "./native-execution-policy-MXEe7PB3.mjs";
-import { n as CodexThreadPolicyHandoffError, o as refreshCodexThreadPolicy } from "./thread-policy-CLTwg3ZA.mjs";
-import { b as isCodexDynamicToolExcluded, f as codexNativeHookRemoteCredentialPath, i as buildCodexNativeHookRelayConfig, l as resolveCodexNativeHookRelayEvents, o as buildCodexNativeHookRelayId, r as assertCodexNativeHookRelayAllowed } from "./native-hook-relay-DQzvuJ-W.mjs";
-import { c as parseCodexNativeToolCatalog, i as checkCodexThreadAppAvailability, n as resolveCodexNativeSkillIsolation, t as applyCodexNativeSkillIsolation } from "./native-skill-isolation-DoRxgQPX.mjs";
-import { c as prepareCodexWorkspaceDeveloperInstructions } from "./attempt-workspace-context-CcwP3DA3.mjs";
-import { n as resolveCodexProviderWebSearchSupportForClient } from "./provider-capabilities-DWH29sy3.mjs";
-import { n as prepareCodexSessionInitialization } from "./session-initialization-Bi_2DKhc.mjs";
-import { createImportedCodexSession } from "./session-history-import-CaO8s6ta.mjs";
+import { n as CodexThreadPolicyHandoffError, o as refreshCodexThreadPolicy } from "./thread-policy-BMRvlOi-.mjs";
+import { b as isCodexDynamicToolExcluded, f as codexNativeHookRemoteCredentialPath, i as buildCodexNativeHookRelayConfig, l as resolveCodexNativeHookRelayEvents, o as buildCodexNativeHookRelayId, r as assertCodexNativeHookRelayAllowed } from "./native-hook-relay-BQ9UkpeG.mjs";
+import { c as parseCodexNativeToolCatalog, i as checkCodexThreadAppAvailability, n as resolveCodexNativeSkillIsolation, t as applyCodexNativeSkillIsolation } from "./native-skill-isolation-CxZRtiWZ.mjs";
+import { c as prepareCodexWorkspaceDeveloperInstructions } from "./attempt-workspace-context-Cr3mI4vp.mjs";
+import { n as resolveCodexProviderWebSearchSupportForClient } from "./provider-capabilities-DOBUBt86.mjs";
+import { n as prepareCodexSessionInitialization } from "./session-initialization-BjVtsTzi.mjs";
+import { createImportedCodexSession } from "./session-history-import-DgwRu2eD.mjs";
 import { isRecord, normalizeOptionalString, readNonBlankString } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { randomUUID } from "node:crypto";
 import { isDeepStrictEqual } from "node:util";

package/dist/.setup/{usage-1eNaNDM2.mjs → usage-BsMyAOaB.mjs}

@@ -1,7 +1,7 @@
 import { t as buildCodexAppServerUsageSnapshot } from "./rate-limits-CI8pTPqL.mjs";
-import { t as readCodexAppServerUsage } from "./request-DInueZ2q.mjs";
-import "./config-C1YVVLEA.mjs";
-import { n as resolveCodexAppServerRuntimeOptions } from "./config-runtime-DWzK-k0n.mjs";
+import { t as readCodexAppServerUsage } from "./request-DhbisYCc.mjs";
+import "./config-G4IGX6bK.mjs";
+import { n as resolveCodexAppServerRuntimeOptions } from "./config-runtime-B8agjie6.mjs";
 import { CODEX_APP_SERVER_AUTH_MARKER } from "openclaw/plugin-sdk/agent-runtime";
 //#region extensions/codex/src/app-server/usage.ts
 /** Handles the synthetic usage credential for a Codex-backed OpenAI route. */

package/dist/.setup/{usage-limit-error-CJoJ_F8V.mjs → usage-limit-error-hLIGKewV.mjs}

@@ -1,7 +1,7 @@
 import { i as isJsonObject } from "./protocol-CANUwXJ3.mjs";
 import { a as shouldRefreshCodexRateLimitsForUsageLimitMessage, i as resolveCodexUsageLimitResetAtMs, n as formatCodexUsageLimitErrorMessage } from "./rate-limits-CI8pTPqL.mjs";
 import { t as CODEX_CONTROL_METHODS } from "./capabilities-DbOzOglY.mjs";
-import { Q as rememberCodexRateLimitsRead, X as readCodexRateLimitsRevision, Z as readRecentCodexRateLimits } from "./shared-client-CCz9ldpr.mjs";
+import { Q as rememberCodexRateLimitsRead, X as readCodexRateLimitsRevision, Z as readRecentCodexRateLimits } from "./shared-client-wb1JBldZ.mjs";
 import { readStringField } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { markAuthProfileBlockedUntil } from "openclaw/plugin-sdk/agent-runtime";
 import { embeddedAgentLog, formatErrorMessage } from "openclaw/plugin-sdk/agent-harness-runtime";

package/dist/.setup/{web-search-provider.runtime-Qq_wUrvv.mjs → web-search-provider.runtime-BJK0lNpc.mjs}

@@ -1,5 +1,5 @@
-import { m as buildCodexNativeWebSearchThreadConfig } from "./thread-requests-BgzJwJtS.mjs";
-import { runBoundedCodexAppServerTurn } from "./bounded-turn-BmChqNaK.mjs";
+import { m as buildCodexNativeWebSearchThreadConfig } from "./thread-requests-BqPhA4Gs.mjs";
+import { runBoundedCodexAppServerTurn } from "./bounded-turn-BpjZixcd.mjs";
 import { t as projectCodexWebSearchItem } from "./web-search-item-CvokaZOo.mjs";
 import { readStringParam, resolveSearchTimeoutSeconds, wrapWebContent } from "openclaw/plugin-sdk/provider-web-search";
 //#region extensions/codex/src/web-search-provider.runtime.ts

package/dist/.setup/{workspace-write-sandbox-probe-BDWO2Qkh.mjs → workspace-write-sandbox-probe-Cyn6cBsp.mjs}

@@ -1,6 +1,6 @@
 import { a as resolveCodexPrivateLauncher, n as isCodexAppServerProxyLaunch } from "./launch-args-DbFCehO7.mjs";
-import { n as resolveCodexAppServerSpawnEnv, r as resolveCodexAppServerSpawnInvocation } from "./transport-stdio-CRWTkKOn.mjs";
-import { t as resolveCodexDoctorStartOptions } from "./doctor-start-options-JjTAl-q_.mjs";
+import { n as resolveCodexAppServerSpawnEnv, r as resolveCodexAppServerSpawnInvocation } from "./transport-stdio-lgeKKHyw.mjs";
+import { t as resolveCodexDoctorStartOptions } from "./doctor-start-options-DedLaoqI.mjs";
 import { runUtf8CommandWithTimeout } from "openclaw/plugin-sdk/process-runtime";
 import path from "node:path";
 import fs from "node:fs/promises";

package/dist/api.js

@@ -1,7 +1,7 @@
-import { i as resolveManagedCodexNativeCommand, s as CODEX_APP_SERVER_VERSION } from "./.setup/managed-binary-BtIjV7yN.mjs";
+import { i as resolveManagedCodexNativeCommand, s as CODEX_APP_SERVER_VERSION } from "./.setup/managed-binary-DwC9wxch.mjs";
 import { t as codexNativeProfileRecoveryHealthCheck } from "./.setup/auth-profile-health-oHizqgye.mjs";
 import { n as findCodexAppServerSpawnError, t as describeCodexSpawnError } from "./.setup/spawn-error-CL3n6MAa.mjs";
-import { t as resolveCodexDoctorStartOptions } from "./.setup/doctor-start-options-JjTAl-q_.mjs";
+import { t as resolveCodexDoctorStartOptions } from "./.setup/doctor-start-options-DedLaoqI.mjs";
 import { runUtf8CommandWithTimeout } from "openclaw/plugin-sdk/process-runtime";
 import path from "node:path";
 import { coerceErrorMessage } from "openclaw/plugin-sdk/error-runtime";
@@ -115,7 +115,7 @@ function registerCodexManagedAppServerDoctorChecks$1(host, deps) {
 const CODEX_PLUGIN_ROOT = path.dirname(fileURLToPath(import.meta.url));
 async function probeCodexWorkspaceWriteSandbox(params) {
 	try {
-		const { probeCodexWorkspaceWriteSandbox: probe } = await import("./.setup/workspace-write-sandbox-probe-BDWO2Qkh.mjs");
+		const { probeCodexWorkspaceWriteSandbox: probe } = await import("./.setup/workspace-write-sandbox-probe-Cyn6cBsp.mjs");
 		return await probe({
 			...params,
 			pluginRoot: CODEX_PLUGIN_ROOT

package/dist/catalog-page.worker.js

@@ -1,4 +1,4 @@
-import { t as createCodexCatalogDecoder } from "./.setup/client-catalog-response-Du2GmrOV.mjs";
+import { t as createCodexCatalogDecoder } from "./.setup/client-catalog-response-DloWE31e.mjs";
 import { serveWorkerTasks } from "openclaw/plugin-sdk/worker-task-server";
 //#region extensions/codex/catalog-page.worker.ts
 const decode = createCodexCatalogDecoder();

package/dist/cli-metadata.js

@@ -2,7 +2,7 @@ import { definePluginEntry } from "openclaw/plugin-sdk/plugin-entry";
 //#region extensions/codex/cli-metadata.ts
 function registerCodexCliMetadata(api) {
 	api.registerCli(async ({ program }) => {
-		const { registerCodexSessionCli } = await import("./.setup/session-cli-GwU0izn-.mjs");
+		const { registerCodexSessionCli } = await import("./.setup/session-cli-BoJSZfGd.mjs");
 		registerCodexSessionCli(program);
 	}, { descriptors: [{
 		name: "codex",