@openclaw/codex 2026.10.5-beta.4 → 2026.10.10-beta.1

package/dist/.setup/{shared-client-BCx1wbyA.mjs → shared-client-CE_uY0A1.mjs}

@@ -1,36 +1,36 @@
-import { i as isJsonObject } from "./protocol-CANUwXJ3.mjs";
-import { n as defineCodexBuildState, t as codexBuildSymbol } from "./build-state-Ds14X10-.mjs";
-import { t as CODEX_APP_SERVER_AUTH_PROVIDER } from "./auth-profile-selection-hr8ocLtz.mjs";
+import { r as isJsonObject } from "./protocol-CaPAVwe9.mjs";
+import { n as defineCodexBuildState, t as codexBuildSymbol } from "./build-state-VcujMRqP.mjs";
+import { t as CODEX_APP_SERVER_AUTH_PROVIDER } from "./auth-profile-selection-Bp5PDk3W.mjs";
 import { n as isCodexAppServerProxyLaunch } from "./launch-args-DbFCehO7.mjs";
-import { a as withEphemeralCodexAuthStore, i as withClearedEnvironmentVariables, n as resolveCodexAppServerLocalHomeDir, r as resolveCodexAppServerUserHomeDir, t as resolveCodexAppServerHomeDir } from "./auth-start-options-BPIPeEX8.mjs";
-import { a as resolveCodexAppServerStartOptionsForAgent, d as readCodexEffectiveConfig, o as resolveCodexComputerUseConfig, t as codexAppServerStartOptionsKey, u as CODEX_SESSION_OVERRIDABLE_LAYER_TYPES } from "./config-options-DDzeNQ8m.mjs";
-import { d as resolveMacOSDesktopCodexBundledMarketplaceCandidates, f as resolveMacOSDesktopCodexComputerUseServiceAppCandidates, i as resolveManagedCodexNativeCommand, l as resolveFirstExistingMacOSDesktopCodexBundledMarketplacePath, r as resolveManagedCodexAppServerStartOptions, t as isManagedCodexDesktopCommand, u as resolveMacOSDesktopCodexAppPathCandidates } from "./managed-binary-BtIjV7yN.mjs";
-import { A as waitForCodexDesktopGeneration, C as retirePendingSharedClientEntryIfUnclaimed, D as waitForUnclaimedSharedClientStartup, _ as observeSharedClientAcquire, a as readCodexCliAuthFileApiKey, b as releaseSharedClientEntry, c as resolveCodexAppServerPreparedApiKeyCacheKey, d as getCurrentSharedClientEntry, f as getOrCreateSharedClientEntry, g as observeAcquire, h as notifyDesktopGenerationDrainChecks, i as fingerprintTokenAuthProfileCacheKey, j as readCodexDesktopArtifactTreeFingerprint, k as isCodexDesktopGenerationCurrent, l as closeSharedClientEntryIfUnclaimed, n as CODEX_AUTH_JSON_FILENAME, o as readFirstNonEmptyEnv, p as getSharedCodexAppServerClientState, r as fingerprintApiKeyAuthProfileCacheKey, s as resolveCodexAppServerFallbackApiKeyCacheKey, t as CODEX_APP_SERVER_API_KEY_ENV_VARS, u as createCodexAppServerStartupLifetime, v as ownCodexStartup, w as retireSharedCodexAppServerClientIfCurrent, x as retainSharedClientEntry, y as recordSharedClientAcquireBoundary } from "./auth-cache-key-f8ODJ_OX.mjs";
-import { n as resolveCodexAppServerSpawnEnv } from "./transport-stdio-CRWTkKOn.mjs";
+import { a as withEphemeralCodexAuthStore, i as withClearedEnvironmentVariables, n as resolveCodexAppServerLocalHomeDir, t as resolveCodexAppServerHomeDir } from "./auth-start-options-BPIPeEX8.mjs";
+import { a as resolveCodexAppServerStartOptionsForAgent, d as readCodexEffectiveConfig, o as resolveCodexComputerUseConfig, t as codexAppServerStartOptionsKey, u as CODEX_SESSION_OVERRIDABLE_LAYER_TYPES } from "./config-options-DMFZkd3X.mjs";
+import { a as isManagedCodexDesktopCommand, b as resolveMacOSDesktopCodexBundledMarketplaceCandidates, c as readInstalledCodexAppServerStatus, f as resolveManagedCodexNativeCommand, i as assertInstalledCodexAppServerVersion, l as rejectInstalledCodexAppServer, r as INSTALLED_CODEX_START_TIMEOUT_MS, u as resolveManagedCodexAppServerStartOptions, v as resolveFirstExistingMacOSDesktopCodexBundledMarketplacePath, x as resolveMacOSDesktopCodexComputerUseServiceAppCandidates, y as resolveMacOSDesktopCodexAppPathCandidates } from "./managed-binary-DbKvGXKl.mjs";
+import { A as waitForUnclaimedSharedClientStartup, C as releaseSharedClientEntry, D as retireSharedCodexAppServerClientIfCurrent, E as retirePendingSharedClientEntryIfUnclaimed, M as waitForCodexDesktopGeneration, N as readCodexDesktopArtifactTreeFingerprint, S as rekeySharedClientEntry, _ as observeAcquire, a as readCodexCliAuthFileApiKey, b as recordSharedClientAcquireBoundary, c as resolveCodexAppServerPreparedApiKeyCacheKey, d as createCodexAppServerStartupLifetime, f as getCurrentSharedClientEntry, g as isSharedCodexFallbackJoinError, i as fingerprintTokenAuthProfileCacheKey, l as SharedCodexFallbackJoinError, m as getSharedCodexAppServerClientState, n as CODEX_AUTH_JSON_FILENAME, o as readFirstNonEmptyEnv, p as getOrCreateSharedClientEntry, r as fingerprintApiKeyAuthProfileCacheKey, s as resolveCodexAppServerFallbackApiKeyCacheKey, t as CODEX_APP_SERVER_API_KEY_ENV_VARS, u as closeSharedClientEntryIfUnclaimed, v as observeSharedClientAcquire, w as retainSharedClientEntry, x as refreshSharedClientIdleRetirement, y as ownCodexStartup } from "./auth-cache-key-CVcYw8HD.mjs";
+import { n as resolveCodexAppServerSpawnEnv } from "./transport-stdio-Bq160Dhv.mjs";
 import { n as CodexAppServerAuthProfileUnavailableError, r as formatCodexAuthProfileUnavailableMessage } from "./auth-profile-recovery-BREezV0L.mjs";
-import { a as codexPrewriteRejectionCause } from "./rpc-error-C98SHchT.mjs";
+import { a as codexPrewriteRejectionCause } from "./rpc-error-DemqqaxE.mjs";
 import { i as withTimeout } from "./timeout-D0mEWSGG.mjs";
-import { n as readCodexSessionMeta } from "./session-catalog-provenance-CmsOE5mh.mjs";
-import { n as observeCodexCatalogClient } from "./session-catalog-events-kR2Ot6nX.mjs";
-import { n as resolveCodexAppServerRuntimeOptions } from "./config-runtime-DWzK-k0n.mjs";
-import { a as resolveCodexAppServerAuthProfileStore, i as resolveCodexAppServerAuthProfileIdForAgent, r as resolveCodexAppServerAuthProfileId, t as isCodexAppServerNativeAuthProfile } from "./auth-profile-CgHQ8Vot.mjs";
-import { i as isCodexResponsesOAuthCredential, n as createCodexResponsesOAuth, o as resolveCodexResponsesOAuthProfileFingerprint, r as isCodexResponsesOAuth, t as CODEX_RESPONSES_OAUTH_PROVIDER } from "./responses-oauth-twnuTaAa.mjs";
-import { N as isUnsupportedCodexAppServerVersionError, t as CodexAppServerClient } from "./client-D93nbdB8.mjs";
-import { n as isCodexWebSocketOpenFailure } from "./transport-websocket-DIyPfkHo.mjs";
-import { t as __exportAll } from "./session-binding-sidecars-DD-enC8w.mjs";
+import { n as readCodexSessionMeta } from "./session-catalog-provenance-Dg9s12z-.mjs";
+import { n as observeCodexCatalogClient } from "./session-catalog-events-DK0opVp3.mjs";
+import { n as resolveCodexAppServerRuntimeOptions } from "./config-runtime-BZRizyuG.mjs";
+import { a as resolveCodexAppServerAuthProfileStore, i as resolveCodexAppServerAuthProfileIdForAgent, r as resolveCodexAppServerAuthProfileId, t as isCodexAppServerNativeAuthProfile } from "./auth-profile-auwzSwwy.mjs";
+import { i as isCodexResponsesOAuthCredential, n as createCodexResponsesOAuth, o as resolveCodexResponsesOAuthProfileFingerprint, r as isCodexResponsesOAuth, t as CODEX_RESPONSES_OAUTH_PROVIDER } from "./responses-oauth-CCV7aVYF.mjs";
+import { t as CodexAppServerClient } from "./client-BS8X7HmG.mjs";
+import { a as isUnsupportedCodexAppServerVersionError } from "./client-initialize-CjgZcX61.mjs";
+import { n as isCodexWebSocketOpenFailure } from "./transport-websocket-0YqiI_MH.mjs";
+import { t as __exportAll } from "./session-binding-sidecars-BNSS6WL4.mjs";
 import { asOptionalRecord, isRecord } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { createHash, randomUUID } from "node:crypto";
 import { isDeepStrictEqual } from "node:util";
 import { AgentHarnessPreflightError, resolveDefaultAgentDir } from "openclaw/plugin-sdk/agent-harness-registration";
 import { addTimerTimeoutGraceMs, resolveTimerTimeoutMs } from "openclaw/plugin-sdk/number-runtime";
-import { resolveGlobalMap } from "openclaw/plugin-sdk/global-singleton";
 import { runExec } from "openclaw/plugin-sdk/process-runtime";
 import fs, { constants, existsSync } from "node:fs";
 import path from "node:path";
 import fs$1 from "node:fs/promises";
 import { extractErrorCode } from "openclaw/plugin-sdk/error-runtime";
 import { createDeferred } from "openclaw/plugin-sdk/extension-shared";
-import { ensureAuthProfileStore, findPersistedAuthProfileCredential, refreshOAuthCredentialForRuntime, resolveApiKeyForProfile, resolvePersistedAuthProfileOwnerAgentDir } from "openclaw/plugin-sdk/agent-runtime";
+import { ensureAuthProfileStoreAsync, findPersistedAuthProfileCredentialAsync, refreshOAuthCredentialForRuntime, resolveApiKeyForProfile, resolvePersistedAuthProfileOwnerAgentDirAsync } from "openclaw/plugin-sdk/agent-runtime";
 import { AgentHarnessPreflightError as AgentHarnessPreflightError$1, embeddedAgentLog as embeddedAgentLog$1, formatErrorMessage as formatErrorMessage$1 } from "openclaw/plugin-sdk/agent-harness-runtime";
 import { hasUsableOAuthCredential, resolveOpenAICodexAuthIdentity } from "openclaw/plugin-sdk/provider-auth";
 import { assertDirectoryIdentitySync, readDirectoryIdentity } from "@openclaw/fs-safe/advanced";
@@ -42,6 +42,7 @@ const CODEX_APP_SERVER_STARTUP_TIMEOUT_FLOOR_MS = 100;
 const CODEX_APP_SERVER_STARTUP_REQUEST_TIMEOUT_MULTIPLE = 10;
 const TURN_TERMINAL_SETTLEMENT_TIMEOUT_MS = 12e4;
 const TURN_FINALIZE_DRAIN_ABORT_GRACE_MS = 5e3;
+const CODEX_APP_SERVER_INITIALIZE_TIMEOUT_MESSAGE = "codex app-server initialize timed out";
 var CodexAppServerStartupError = class extends Error {
 	constructor(reason, message = reason === "timed_out" ? "codex app-server startup timed out" : "codex app-server startup aborted") {
 		super(message);
@@ -50,6 +51,10 @@ var CodexAppServerStartupError = class extends Error {
 		this.name = "CodexAppServerStartupError";
 	}
 };
+function buildCodexAppServerInitializeTimeoutError(client) {
+	const stderr = client?.getStderrDiagnostic();
+	return new CodexAppServerStartupError("timed_out", stderr ? `${CODEX_APP_SERVER_INITIALIZE_TIMEOUT_MESSAGE}; stderr=${JSON.stringify(stderr)}` : CODEX_APP_SERVER_INITIALIZE_TIMEOUT_MESSAGE);
+}
 function isCodexAppServerStartupError(error, reason) {
 	const cause = codexPrewriteRejectionCause(error);
 	return cause instanceof Error && "code" in cause && cause.code === "CODEX_APP_SERVER_STARTUP_CANCELLED" && "reason" in cause && (cause.reason === "aborted" || cause.reason === "timed_out") && (reason === void 0 || cause.reason === reason);
@@ -141,7 +146,7 @@ async function prepareOwnedServiceParent(params) {
 	await ensureRealDirectoryTree(params.ownershipRoot, params.targetParent, "Computer Use service parent");
 	await assertServicePathParents(params.ownershipRoot, params.targetParent, false);
 	const [rootIdentity, parentIdentity] = await Promise.all([readRealDirectoryIdentity(params.ownershipRoot, "Computer Use ownership root"), readRealDirectoryIdentity(params.targetParent, "Computer Use service parent")]);
-	assertPathAtOrInside(rootIdentity.realPath, parentIdentity.realPath, "canonical Computer Use service parent");
+	assertPathAtOrInside(rootIdentity.realPath, parentIdentity.realPath, "resolved Computer Use service parent");
 	return parentIdentity;
 }
 async function assertOwnedCodexHomePath(params) {
@@ -238,39 +243,20 @@ async function ensureCodexComputerUseSharedPluginCache(params) {
 	const physicalCacheRoot = path.dirname(physicalCachePath);
 	const stagingRoot = await fs$1.mkdtemp(path.join(physicalCacheRoot, `.${cacheName}.staging-`));
 	const stagedPath = path.join(stagingRoot, cacheName);
-	const backupPath = path.join(physicalCacheRoot, `.${cacheName}.backup-${process.pid}-${Date.now()}`);
-	let backupCreated = false;
 	try {
 		const physicalSourceRoot = await fs$1.realpath(sourcePluginRoot);
 		await fs$1.cp(physicalSourceRoot, stagedPath, { recursive: true });
-		await waitForCodexDesktopGeneration();
 		if (ownedParent) await assertDirectoryIdentityStable(ownedParent, "Computer Use plugin cache parent");
 		if (stat) {
 			params.assertCurrent?.();
-			await fs$1.rename(physicalCachePath, backupPath);
-			backupCreated = true;
-		}
-		try {
-			if (ownedParent) await assertDirectoryIdentityStable(ownedParent, "Computer Use plugin cache parent");
-			params.assertCurrent?.();
-			await fs$1.rename(stagedPath, physicalCachePath);
-		} catch (error) {
-			if (backupCreated) try {
-				if (ownedParent) await assertDirectoryIdentityStable(ownedParent, "Computer Use plugin cache parent");
-				await fs$1.rename(backupPath, physicalCachePath);
-				backupCreated = false;
-			} catch (restoreError) {
-				throw new Error(`Failed to install Computer Use cache ${cachePath} and restore its prior copy: ${String(error)}`, { cause: restoreError });
-			}
-			throw error;
-		}
-		if (backupCreated) {
-			if (ownedParent) await assertDirectoryIdentityStable(ownedParent, "Computer Use plugin cache parent");
-			await fs$1.rm(backupPath, {
+			await fs$1.rm(physicalCachePath, {
 				recursive: true,
 				force: true
 			});
+			if (ownedParent) await assertDirectoryIdentityStable(ownedParent, "Computer Use plugin cache parent");
 		}
+		params.assertCurrent?.();
+		await fs$1.rename(stagedPath, physicalCachePath);
 	} finally {
 		if (!ownedParent || await directoryIdentityIsStable(ownedParent)) await fs$1.rm(stagingRoot, {
 			recursive: true,
@@ -456,11 +442,7 @@ async function ensureCodexManagedBundledMarketplace(params) {
 	const physicalTargetPath = path.join(parent.realPath, MARKETPLACE_NAME);
 	await assertNotSymlink(physicalTargetPath, "managed bundled marketplace");
 	const active = activeInstalls$1.get(physicalTargetPath);
-	if (active) {
-		if (active.sourcePath === source.bundledMarketplacePath) return await active.promise;
-		await active.promise.catch(() => void 0);
-		return await ensureCodexManagedBundledMarketplace(params);
-	}
+	if (active) return await active;
 	const install = publishManagedWrapper({
 		parent,
 		physicalTargetPath,
@@ -470,23 +452,17 @@ async function ensureCodexManagedBundledMarketplace(params) {
 		ownershipCandidates: params.ownershipCandidates ?? candidates,
 		assertCurrent: params.assertCurrent
 	});
-	const activeEntry = {
-		sourcePath: source.bundledMarketplacePath,
-		promise: install
-	};
-	activeInstalls$1.set(physicalTargetPath, activeEntry);
-	const clearActive = () => {
-		if (activeInstalls$1.get(physicalTargetPath) === activeEntry) activeInstalls$1.delete(physicalTargetPath);
-	};
-	install.then(clearActive, clearActive);
-	return await install;
+	activeInstalls$1.set(physicalTargetPath, install);
+	try {
+		return await install;
+	} finally {
+		activeInstalls$1.delete(physicalTargetPath);
+	}
 }
 async function publishManagedWrapper(params) {
 	const { parent, physicalTargetPath, targetPath, source, ownershipCandidates, assertCurrent } = params;
 	if (await wrapperMatches(physicalTargetPath, source.bundledMarketplacePath, params.unifiedRuntime)) return targetPath;
 	const stagingPath = await fs$1.mkdtemp(path.join(parent.realPath, `.${MARKETPLACE_NAME}.staging-`));
-	const backupPath = path.join(parent.realPath, `.${MARKETPLACE_NAME}.backup-${process.pid}-${Date.now()}`);
-	let backupCreated = false;
 	try {
 		const manifestParent = path.join(stagingPath, ".agents", "plugins");
 		await fs$1.mkdir(manifestParent, {
@@ -504,9 +480,6 @@ async function publishManagedWrapper(params) {
 			}
 			await fs$1.writeFile(path.join(stagingPath, UNIFIED_SOURCE_FINGERPRINT), params.unifiedRuntime.sourceFingerprint, { mode: 384 });
 		} else await fs$1.symlink(path.join(source.bundledMarketplacePath, "plugins"), path.join(stagingPath, "plugins"));
-		await waitForCodexDesktopGeneration();
-		assertCurrent?.();
-		await assertDirectoryIdentityStable(parent, "managed bundled marketplace parent");
 		const existing = await fs$1.lstat(physicalTargetPath).catch((error) => {
 			if (extractErrorCode(error) === "ENOENT") return;
 			throw error;
@@ -514,32 +487,14 @@ async function publishManagedWrapper(params) {
 		if (existing && !existing.isDirectory()) throw new Error(`Managed bundled marketplace must be a real directory: ${targetPath}`);
 		if (existing && !await wrapperMatchesAnySource(physicalTargetPath, ownershipCandidates)) throw new Error(`Refusing to replace an unowned bundled marketplace directory: ${targetPath}`);
 		if (existing) {
-			assertCurrent?.();
-			await fs$1.rename(physicalTargetPath, backupPath);
-			backupCreated = true;
 			await assertDirectoryIdentityStable(parent, "managed bundled marketplace parent");
+			assertCurrent?.();
+			await fs$1.rm(physicalTargetPath, { recursive: true });
 		}
+		await assertDirectoryIdentityStable(parent, "managed bundled marketplace parent");
 		assertCurrent?.();
 		await fs$1.rename(stagingPath, physicalTargetPath);
-		await assertDirectoryIdentityStable(parent, "managed bundled marketplace parent");
-		if (backupCreated) {
-			await fs$1.rm(backupPath, { recursive: true });
-			backupCreated = false;
-		}
 		return targetPath;
-	} catch (error) {
-		if (backupCreated) try {
-			await assertDirectoryIdentityStable(parent, "managed bundled marketplace parent");
-			if (await fs$1.lstat(physicalTargetPath).catch(() => void 0)) {
-				if (!await wrapperOwnedBySource(physicalTargetPath, source.bundledMarketplacePath)) throw new Error("managed bundled marketplace replacement is no longer owned", { cause: error });
-				await fs$1.rm(physicalTargetPath, { recursive: true });
-			}
-			await fs$1.rename(backupPath, physicalTargetPath);
-			backupCreated = false;
-		} catch (restoreError) {
-			throw new Error(`Failed to restore the prior managed bundled marketplace: ${String(error)}`, { cause: restoreError });
-		}
-		throw error;
 	} finally {
 		if (await directoryIdentityIsStable(parent)) await fs$1.rm(stagingPath, {
 			recursive: true,
@@ -646,13 +601,8 @@ async function ensureCodexComputerUseServiceApp(params) {
 		targetPath
 	});
 	const candidates = params.sourceAppCandidates ?? resolveMacOSDesktopCodexComputerUseServiceAppCandidates(platform, params.appServerCommand);
-	const syncKey = [targetPath, ...candidates].join("\0");
 	const active = activeInstalls.get(targetPath);
-	if (active) {
-		if (active.syncKey === syncKey) return await active.promise;
-		await active.promise.catch(() => void 0);
-		return await ensureCodexComputerUseServiceApp(params);
-	}
+	if (active) return await active;
 	const install = ensureCodexComputerUseServiceAppOnce({
 		...params,
 		codexHome,
@@ -661,16 +611,12 @@ async function ensureCodexComputerUseServiceApp(params) {
 		targetPath,
 		sourceAppCandidates: candidates
 	});
-	const activeEntry = {
-		syncKey,
-		promise: install
-	};
-	activeInstalls.set(targetPath, activeEntry);
-	const clearActive = () => {
-		if (activeInstalls.get(targetPath) === activeEntry) activeInstalls.delete(targetPath);
-	};
-	install.then(clearActive, clearActive);
-	return await install;
+	activeInstalls.set(targetPath, install);
+	try {
+		return await install;
+	} finally {
+		activeInstalls.delete(targetPath);
+	}
 }
 async function ensureCodexComputerUseServiceAppOnce(params) {
 	const inspectServiceApp = params.inspectServiceApp ?? inspectTrustedServiceApp;
@@ -695,30 +641,15 @@ async function ensureCodexComputerUseServiceAppOnce(params) {
 	});
 	const operationTargetPath = path.join(ownedParent.realPath, SERVICE_APP_NAME);
 	await assertNotSymlink(operationTargetPath, "Computer Use service target");
-	const initialTarget = await readServiceAppSnapshot(operationTargetPath, inspectServiceApp);
-	if (initialTarget.identity && identitiesMatch(initialTarget.identity, sourceIdentity)) return alreadyCurrent;
+	const targetExisted = await pathExists$1(operationTargetPath);
+	const initialIdentity = await inspectServiceApp(operationTargetPath);
+	if (initialIdentity && identitiesMatch(initialIdentity, sourceIdentity)) return alreadyCurrent;
 	await assertDirectoryIdentityStable(ownedParent, SERVICE_PARENT_LABEL);
 	const stagingRoot = await fs$1.mkdtemp(path.join(ownedParent.realPath, ".service-app.staging-"));
 	const stagingRootIdentity = await readRealDirectoryIdentity(stagingRoot, "Computer Use service staging directory");
 	const stagedPath = path.join(stagingRoot, SERVICE_APP_NAME);
 	const backupPath = path.join(ownedParent.realPath, `.service-app.backup-${process.pid}-${Date.now()}`);
 	let backupCreated = false;
-	const restoreBackup = async () => {
-		await assertDirectoryIdentityStable(ownedParent, SERVICE_PARENT_LABEL);
-		await fs$1.rename(backupPath, operationTargetPath);
-		await assertDirectoryIdentityStable(ownedParent, SERVICE_PARENT_LABEL);
-		backupCreated = false;
-	};
-	const removeBackup = async () => {
-		await assertDirectoryIdentityStable(ownedParent, SERVICE_PARENT_LABEL);
-		await assertNotSymlink(backupPath, "Computer Use service backup");
-		await fs$1.rm(backupPath, {
-			recursive: true,
-			force: true
-		});
-		await assertDirectoryIdentityStable(ownedParent, SERVICE_PARENT_LABEL);
-		backupCreated = false;
-	};
 	try {
 		await (params.copyServiceApp ?? copyServiceAppWithDitto)(sourcePath, stagedPath);
 		await assertDirectoryIdentityStable(ownedParent, SERVICE_PARENT_LABEL);
@@ -726,69 +657,42 @@ async function ensureCodexComputerUseServiceAppOnce(params) {
 		await assertNotSymlink(stagedPath, "Copied Computer Use service app");
 		const stagedIdentity = await inspectServiceApp(stagedPath);
 		if (!stagedIdentity || !identitiesMatch(stagedIdentity, sourceIdentity)) throw new Error(`Copied Computer Use service app at ${stagedPath} does not match its selected signed source.`);
-		const stagedSnapshot = await readServiceAppSnapshot(stagedPath, inspectServiceApp);
-		const currentSourceIdentity = await inspectServiceApp(sourcePath);
-		await waitForCodexDesktopGeneration();
 		await assertDirectoryIdentityStable(ownedParent, SERVICE_PARENT_LABEL);
 		await assertDirectoryIdentityStable(stagingRootIdentity, "Computer Use service staging directory");
-		if (!currentSourceIdentity || !identitiesMatch(currentSourceIdentity, sourceIdentity)) throw new Error("Selected Computer Use service source changed during refresh.");
 		await assertNotSymlink(operationTargetPath, "Computer Use service target");
 		if (await pathExists$1(operationTargetPath)) {
 			await assertDirectoryIdentityStable(ownedParent, SERVICE_PARENT_LABEL);
 			params.assertCurrent?.();
 			await fs$1.rename(operationTargetPath, backupPath);
-			await assertDirectoryIdentityStable(ownedParent, SERVICE_PARENT_LABEL);
 			backupCreated = true;
-			const movedTarget = await readServiceAppSnapshot(backupPath, inspectServiceApp);
-			if (movedTarget.identity && identitiesMatch(movedTarget.identity, sourceIdentity)) {
-				await restoreBackup();
-				return alreadyCurrent;
-			}
-			if (!snapshotsMatch(initialTarget, movedTarget)) {
-				await restoreBackup();
-				throw new Error("Computer Use service target changed to an unexpected generation during refresh.");
-			}
-		}
-		try {
-			await assertDirectoryIdentityStable(ownedParent, SERVICE_PARENT_LABEL);
-			params.assertCurrent?.();
-			await fs$1.rename(stagedPath, operationTargetPath);
-			await assertDirectoryIdentityStable(ownedParent, SERVICE_PARENT_LABEL);
-		} catch (error) {
-			await assertDirectoryIdentityStable(ownedParent, SERVICE_PARENT_LABEL);
-			await assertNotSymlink(operationTargetPath, "Computer Use service target");
-			const winnerIdentity = await inspectServiceApp(operationTargetPath);
-			if (!winnerIdentity || !identitiesMatch(winnerIdentity, sourceIdentity)) {
-				if (backupCreated && !await pathExists$1(operationTargetPath)) await restoreBackup();
-				throw error;
-			}
-			if (backupCreated) await removeBackup();
-			return alreadyCurrent;
 		}
+		await assertDirectoryIdentityStable(ownedParent, SERVICE_PARENT_LABEL);
+		params.assertCurrent?.();
+		await fs$1.rename(stagedPath, operationTargetPath);
 		await assertNotSymlink(operationTargetPath, "Installed Computer Use service app");
-		const installedSnapshot = await readServiceAppSnapshot(operationTargetPath, inspectServiceApp);
-		if (!installedSnapshot.identity || !identitiesMatch(installedSnapshot.identity, sourceIdentity)) {
-			if (filesystemSnapshotsMatch(installedSnapshot, stagedSnapshot)) {
-				await assertDirectoryIdentityStable(ownedParent, SERVICE_PARENT_LABEL);
-				await fs$1.rm(operationTargetPath, {
-					recursive: true,
-					force: true
-				});
-				await assertDirectoryIdentityStable(ownedParent, SERVICE_PARENT_LABEL);
-				if (backupCreated) {
-					await fs$1.rename(backupPath, operationTargetPath);
-					await assertDirectoryIdentityStable(ownedParent, SERVICE_PARENT_LABEL);
-					backupCreated = false;
-				}
-			}
+		const installedIdentity = await inspectServiceApp(operationTargetPath);
+		if (!installedIdentity || !identitiesMatch(installedIdentity, sourceIdentity)) {
+			await assertDirectoryIdentityStable(ownedParent, SERVICE_PARENT_LABEL);
+			await fs$1.rm(operationTargetPath, {
+				recursive: true,
+				force: true
+			});
 			throw new Error("Installed Computer Use service app failed post-install identity verification.");
 		}
-		if (backupCreated) await removeBackup();
+		if (backupCreated) {
+			await assertDirectoryIdentityStable(ownedParent, SERVICE_PARENT_LABEL);
+			await assertNotSymlink(backupPath, "Computer Use service backup");
+			await fs$1.rm(backupPath, {
+				recursive: true,
+				force: true
+			});
+			backupCreated = false;
+		}
 		return {
 			...alreadyCurrent,
-			status: initialTarget.exists ? "refreshed" : "installed",
+			status: targetExisted ? "refreshed" : "installed",
 			changed: true,
-			...initialTarget.identity ? { previousBuild: initialTarget.identity.build } : {}
+			...initialIdentity ? { previousBuild: initialIdentity.build } : {}
 		};
 	} catch (error) {
 		if (backupCreated && await directoryIdentityIsStable(ownedParent) && !await pathExists$1(operationTargetPath)) {
@@ -816,32 +720,6 @@ async function findUsableServiceApp(candidates, inspectServiceApp) {
 		};
 	}
 }
-async function readServiceAppSnapshot(appPath, inspectServiceApp) {
-	if (!await pathExists$1(appPath)) return { exists: false };
-	return {
-		exists: true,
-		identity: await inspectServiceApp(appPath),
-		filesystemKey: await readServiceAppFilesystemKey(appPath)
-	};
-}
-async function readServiceAppFilesystemKey(appPath) {
-	const paths = [
-		appPath,
-		path.join(appPath, "Contents", "Info.plist"),
-		path.join(appPath, CLIENT_RELATIVE_PATH)
-	];
-	return (await Promise.all(paths.map((entryPath) => fs$1.stat(entryPath).then((stat) => `${stat.dev}:${stat.ino}:${stat.size}:${stat.mtimeMs}`, () => "missing")))).join("|");
-}
-function snapshotsMatch(left, right) {
-	if (left.exists !== right.exists) return false;
-	if (!left.exists) return true;
-	if (left.filesystemKey && right.filesystemKey && left.filesystemKey !== right.filesystemKey) return false;
-	if (left.identity || right.identity) return Boolean(left.identity && right.identity && identitiesMatch(left.identity, right.identity));
-	return left.filesystemKey !== void 0 && left.filesystemKey === right.filesystemKey;
-}
-function filesystemSnapshotsMatch(left, right) {
-	return Boolean(left.exists && right.exists && left.filesystemKey && left.filesystemKey === right.filesystemKey);
-}
 function identitiesMatch(left, right) {
 	return left.bundleId === right.bundleId && left.version === right.version && left.build === right.build && left.cdHash === right.cdHash && left.teamId === right.teamId && left.clientBundleId === right.clientBundleId && left.clientCdHash === right.clientCdHash && left.clientTeamId === right.clientTeamId;
 }
@@ -957,7 +835,7 @@ async function bridgeCodexAppServerStartOptions(params) {
 		return withClearedEnvironmentVariables(scopedStartOptions, CODEX_APP_SERVER_PREPARED_AUTH_ENV_VARS);
 	}
 	if (params.authProfileId === null) return scopeStartOptions();
-	const store = resolveCodexAppServerAuthProfileStore({
+	const store = await resolveCodexAppServerAuthProfileStore({
 		agentDir: params.agentDir,
 		authProfileId: params.authProfileId,
 		authProfileStore: params.authProfileStore,
@@ -976,7 +854,10 @@ async function bridgeCodexAppServerStartOptions(params) {
 	}) ? withClearedEnvironmentVariables(scopedStartOptions, CODEX_APP_SERVER_API_KEY_ENV_VARS) : scopedStartOptions;
 }
 function assertNoUnimportedAgentCodexAuthFile(params) {
-	if (params.authRequirement === "api-key" && resolveCodexAppServerFallbackApiKeyCacheKey({ startOptions: params.startOptions })) return;
+	if ((params.authRequirement === "api-key" || params.authRequirement === "environment-api-key") && resolveCodexAppServerFallbackApiKeyCacheKey({
+		startOptions: params.startOptions,
+		allowNativeAuthFile: params.authRequirement === "api-key"
+	})) return;
 	if (params.startOptions.transport !== "stdio" || params.startOptions.homeScope === "user") return;
 	const codexHome = resolveCodexAppServerHomeDir(params.agentDir);
 	const authPath = path.join(codexHome, CODEX_AUTH_JSON_FILENAME);
@@ -984,9 +865,9 @@ function assertNoUnimportedAgentCodexAuthFile(params) {
 	const targetAgentId = params.agentId?.trim() || "<agent-id>";
 	throw new AgentHarnessPreflightError(`A Codex auth file exists at ${authPath}, but agent-scoped Codex runs use OpenClaw's auth store and do not read that file. Preview only that credential import with \`openclaw migrate plan codex --from <codex-home> --agent ${targetAgentId} --include-secrets --item auth:openai\`, then run \`openclaw migrate apply codex --from <codex-home> --agent ${targetAgentId} --include-secrets --item auth:openai --yes\`. If the plan finds no credentials, remove the stale auth file.`);
 }
-function resolveCodexAppServerAuthProfile(params) {
+async function resolveCodexAppServerAuthProfile(params) {
 	const agentDir = params.agentDir?.trim() || resolveDefaultAgentDir(params.config ?? {});
-	const store = resolveCodexAppServerAuthProfileStore({
+	const store = await resolveCodexAppServerAuthProfileStore({
 		...params,
 		agentDir
 	});
@@ -1006,7 +887,7 @@ function resolveCodexAppServerAuthProfile(params) {
 }
 /** Resolves prepared profile login material once so cache identity and RPC login cannot drift. */
 async function resolveCodexAppServerPreparedAuthProfileSnapshot(params) {
-	const profile = resolveCodexAppServerAuthProfile(params);
+	const profile = await resolveCodexAppServerAuthProfile(params);
 	if (!profile) return;
 	const { agentDir, store, profileId, credential } = profile;
 	if (isCodexResponsesOAuthCredential(credential)) return {
@@ -1074,7 +955,7 @@ async function resolveCodexAppServerPreparedAuthHandoff(params) {
 	}
 	const authProfileId = params.authProfileId?.trim() || void 0;
 	if (authProfileId && !params.authProfileStore.profiles[authProfileId]) throw new CodexAppServerAuthProfileUnavailableError(formatCodexAuthProfileUnavailableMessage(authProfileId));
-	const nativeAuthProfile = isCodexAppServerNativeAuthProfile({
+	const nativeAuthProfile = await isCodexAppServerNativeAuthProfile({
 		authProfileId,
 		authProfileStore: params.authProfileStore,
 		agentDir: params.agentDir,
@@ -1102,7 +983,7 @@ async function resolveCodexAppServerPreparedAuthHandoff(params) {
 	};
 }
 async function resolveCodexAppServerAuthAccountCacheKey(params) {
-	const profile = resolveCodexAppServerAuthProfile(params);
+	const profile = await resolveCodexAppServerAuthProfile(params);
 	if (!profile) return;
 	const { agentDir, store, profileId, credential } = profile;
 	const accountId = resolveChatgptAccountId(profileId, credential);
@@ -1148,12 +1029,7 @@ async function reconcileCodexComputerUseStartArtifacts(params) {
 	else activeComputerUseArtifactReconciliations.delete(key);
 	activeComputerUseArtifactReconciliations.set(key, owner);
 	owner.active += 1;
-	const epoch = params.desktopGeneration?.epoch;
-	if (epoch !== void 0 && (owner.latestEpoch === void 0 || epoch > owner.latestEpoch)) owner.latestEpoch = epoch;
-	const assertCurrent = () => {
-		params.assertCurrent?.();
-		if (epoch !== void 0 && owner.latestEpoch !== epoch) throw new Error("Codex Computer Use artifact reconciliation was superseded.");
-	};
+	const assertCurrent = () => params.assertCurrent?.();
 	const operation = owner.tail.then(async () => {
 		assertCurrent();
 		const appliedCacheBinding = await reconcileCodexComputerUseStartArtifactsOnce({
@@ -1165,13 +1041,11 @@ async function reconcileCodexComputerUseStartArtifacts(params) {
 		assertCurrent();
 		owner.appliedCacheBinding = appliedCacheBinding;
 	});
-	const settled = operation.catch(() => void 0);
-	owner.tail = settled;
+	owner.tail = operation.catch(() => void 0);
 	try {
 		await operation;
 	} finally {
-		owner.active = Math.max(0, owner.active - 1);
-		if (owner.active === 0 && owner.latestEpoch === void 0 && activeComputerUseArtifactReconciliations.get(key) === owner && owner.tail === settled) activeComputerUseArtifactReconciliations.delete(key);
+		owner.active -= 1;
 		pruneComputerUseArtifactOwners();
 	}
 }
@@ -1265,9 +1139,14 @@ var CodexComputerUseCandidateArtifactsUnavailableError = class extends Error {
 	}
 };
 async function applyCodexAppServerAuthProfile(params) {
+	const withCurrent = async (write) => {
+		await params.assertCurrentAsync?.();
+		params.assertCurrent?.();
+		write();
+	};
 	params.assertCurrent?.();
 	if (!params.preparedAuth && params.authProfileId === null) {
-		await assertNativeCodexAccountMatchesRoute(params.client, params.authRequirement, params.assertCurrent);
+		await assertNativeCodexAccountMatchesRoute(params.client, params.authRequirement, params.assertCurrent, withCurrent);
 		return;
 	}
 	const agentDir = params.agentDir ?? resolveDefaultAgentDir(params.config ?? {});
@@ -1277,7 +1156,7 @@ async function applyCodexAppServerAuthProfile(params) {
 	} : await resolveCodexAppServerAuthProfileLoginParamsInternal({
 		agentDir,
 		authProfileId: params.authProfileId ?? void 0,
-		authProfileStore: resolveCodexAppServerAuthProfileStore({
+		authProfileStore: await resolveCodexAppServerAuthProfileStore({
 			...params,
 			agentDir,
 			authProfileId: params.authProfileId ?? void 0
@@ -1285,18 +1164,22 @@ async function applyCodexAppServerAuthProfile(params) {
 		config: params.config
 	});
 	if (params.authRequirement === "subscription" && loginParams?.type !== "chatgptAuthTokens") throw createCodexAppServerAuthError("Codex subscription auth profile could not produce login credentials. Sign in with `openclaw models auth login --provider openai`, select that profile, then retry.");
-	if (!loginParams && params.authRequirement === "api-key" && params.startOptions?.transport === "stdio") {
+	if (!loginParams && (params.authRequirement === "api-key" || params.authRequirement === "environment-api-key") && params.startOptions?.transport === "stdio") {
 		const env = resolveCodexAppServerSpawnEnv(params.startOptions, process.env);
 		loginParams = await resolveCodexAppServerFallbackApiKeyLoginParams({
 			client: params.client,
 			env,
-			codexCliAuthEnv: process.env,
-			assertCurrent: params.assertCurrent
+			...params.authRequirement === "api-key" ? { codexCliAuthEnv: process.env } : {},
+			assertCurrent: params.assertCurrent,
+			withCurrent
 		});
 	}
 	if (loginParams) {
 		try {
-			await params.client.request("account/login/start", loginParams, { assertCurrent: params.assertCurrent });
+			await params.client.request("account/login/start", loginParams, {
+				assertCurrent: params.assertCurrent,
+				withCurrent
+			});
 		} catch (error) {
 			throw codexPrewriteRejectionCause(error);
 		}
@@ -1316,9 +1199,12 @@ async function applyCodexAppServerAuthProfile(params) {
 * ChatGPT plan. An absent account is left alone because the native home may serve a
 * custom model provider that reports no OpenAI account at all.
 */
-async function assertNativeCodexAccountMatchesRoute(client, authRequirement, assertCurrent) {
+async function assertNativeCodexAccountMatchesRoute(client, authRequirement, assertCurrent, withCurrent) {
 	if (!authRequirement) return;
-	const accountType = (await client.request("account/read", { refreshToken: false }, { assertCurrent })).account?.type;
+	const accountType = (await client.request("account/read", { refreshToken: false }, {
+		assertCurrent,
+		withCurrent
+	})).account?.type;
 	if (authRequirement === "subscription") {
 		if (accountType !== "chatgpt") throw createCodexAppServerAuthError("Codex subscription route requires ChatGPT auth in the native Codex home. Run `codex login` for that home, or use appServer.homeScope=\"agent\" with an OpenClaw OAuth profile, then retry.");
 		return;
@@ -1333,7 +1219,7 @@ async function refreshCodexAppServerAuthTokens(params) {
 	const handoffAccountId = params.authHandoff?.chatgptAccountId.trim();
 	if (previousAccountId && handoffAccountId && previousAccountId !== handoffAccountId) throw codexWorkspaceChangedError("before");
 	if (previousAccountId) {
-		const store = resolveCodexAppServerAuthProfileStore(params);
+		const store = await resolveCodexAppServerAuthProfileStore(params);
 		const profileId = resolveCodexAppServerAuthProfileId({
 			...params,
 			store
@@ -1355,7 +1241,7 @@ async function refreshCodexAppServerAuthTokens(params) {
 	};
 }
 async function resolveCodexAppServerAuthProfileLoginParamsInternal(params) {
-	const store = resolveCodexAppServerAuthProfileStore(params);
+	const store = await resolveCodexAppServerAuthProfileStore(params);
 	const profileId = resolveCodexAppServerAuthProfileId({
 		...params,
 		store
@@ -1363,7 +1249,7 @@ async function resolveCodexAppServerAuthProfileLoginParamsInternal(params) {
 	if (!profileId) return;
 	const credential = store.profiles[profileId];
 	if (!credential) throw new CodexAppServerAuthProfileUnavailableError(formatCodexAuthProfileUnavailableMessage(profileId));
-	if (!isCodexAppServerAuthProvider(credential.provider)) throw new CodexAppServerAuthProfileUnavailableError(`Codex app-server auth profile "${profileId}" must use the canonical OpenAI auth provider; run "openclaw doctor --fix" to migrate legacy provider IDs.`);
+	if (!isCodexAppServerAuthProvider(credential.provider)) throw new CodexAppServerAuthProfileUnavailableError(`Codex app-server auth profile "${profileId}" must use the OpenAI auth provider; run "openclaw doctor --fix" to migrate legacy provider IDs.`);
 	const preferStoreCredential = Boolean(params.authProfileStore?.profiles[profileId]);
 	let loginCredential = credential;
 	let value;
@@ -1371,7 +1257,7 @@ async function resolveCodexAppServerAuthProfileLoginParamsInternal(params) {
 	if (credential.type === "api_key" || credential.type === "token") {
 		value = (await resolveApiKeyForProfile({
 			cfg: params.config,
-			store: preferStoreCredential ? store : ensureAuthProfileStore(params.agentDir, {
+			store: preferStoreCredential ? store : await ensureAuthProfileStoreAsync(params.agentDir, {
 				allowKeychainPrompt: false,
 				profileId,
 				config: params.config
@@ -1396,27 +1282,30 @@ async function resolveCodexAppServerAuthProfileLoginParamsInternal(params) {
 	} : buildChatgptAuthTokensParams(profileId, loginCredential, value);
 }
 async function resolveCodexAppServerFallbackApiKeyLoginParams(params) {
-	const apiKey = readFirstNonEmptyEnv(params.env, CODEX_APP_SERVER_API_KEY_ENV_VARS) ?? await readCodexCliAuthFileApiKey(params.codexCliAuthEnv);
+	const apiKey = readFirstNonEmptyEnv(params.env, CODEX_APP_SERVER_API_KEY_ENV_VARS) ?? (params.codexCliAuthEnv ? await readCodexCliAuthFileApiKey(params.codexCliAuthEnv) : void 0);
 	if (!apiKey) return;
-	if ((await params.client.request("account/read", { refreshToken: false }, { assertCurrent: params.assertCurrent })).account) return;
+	if ((await params.client.request("account/read", { refreshToken: false }, {
+		assertCurrent: params.assertCurrent,
+		withCurrent: params.withCurrent
+	})).account) return;
 	return {
 		type: "apiKey",
 		apiKey
 	};
 }
 async function resolveOAuthCredentialForCodexAppServer(profileId, credential, params) {
-	const ownerAgentDir = resolvePersistedAuthProfileOwnerAgentDir({
+	const ownerAgentDir = await resolvePersistedAuthProfileOwnerAgentDirAsync({
 		agentDir: params.agentDir,
 		profileId
 	});
-	const persistedCredential = findPersistedAuthProfileCredential({
+	const persistedCredential = await findPersistedAuthProfileCredentialAsync({
 		agentDir: ownerAgentDir,
 		profileId
 	});
 	const persistedProfile = params.store.runtimePersistedProfileIds?.includes(profileId);
 	const useScopedCredential = params.preferStoreCredential && (!persistedProfile || persistedCredential?.type === "oauth" && isCodexAppServerAuthProvider(persistedCredential.provider) && !isDeepStrictEqual(persistedCredential, credential) && !hasMatchingOAuthIdentity(persistedCredential, credential));
 	if (params.preferStoreCredential && persistedProfile && (persistedCredential?.type !== "oauth" || !isCodexAppServerAuthProvider(persistedCredential.provider))) throw new CodexAppServerAuthProfileUnavailableError(`Codex app-server auth profile "${profileId}" is no longer an OpenAI OAuth credential in its persisted OpenClaw store. Run "openclaw doctor" to inspect credential ownership, or select an existing OpenAI profile.`);
-	const store = useScopedCredential ? params.store : resolveCodexAppServerAuthProfileStore({
+	const store = useScopedCredential ? params.store : await resolveCodexAppServerAuthProfileStore({
 		agentDir: ownerAgentDir,
 		authProfileId: profileId,
 		config: params.config
@@ -1504,14 +1393,16 @@ async function resolveScopedOAuthCredential(params) {
 			cfg: params.config
 		});
 		if (!refreshed?.access?.trim()) throw new Error(`Codex app-server auth profile "${params.profileId}" could not refresh. Sign in again with OpenClaw, then retry.`);
-		assertCodexOAuthRefreshWorkspace(params.profileId, refreshed, params.expectedAccountId);
+		assertCodexOAuthRefreshWorkspace(params.profileId, refreshed, resolveOpenAICodexAuthIdentity(credential).accountId?.trim());
 		if (!isDeepStrictEqual(params.store.profiles[params.profileId], credential)) throw new Error(`Codex app-server auth profile "${params.profileId}" changed while refreshing. Retry with the newly selected OpenAI profile.`);
 		params.store.profiles[params.profileId] = refreshed;
 		return refreshed;
 	})();
 	storeRefreshes.set(params.profileId, refresh);
 	try {
-		return await refresh;
+		const refreshed = await refresh;
+		assertCodexOAuthRefreshWorkspace(params.profileId, refreshed, params.expectedAccountId);
+		return refreshed;
 	} finally {
 		if (storeRefreshes.get(params.profileId) === refresh) storeRefreshes.delete(params.profileId);
 	}
@@ -1560,6 +1451,62 @@ function resolveExplicitChatgptAccountId(credential) {
 	return "accountId" in credential && typeof credential.accountId === "string" ? credential.accountId.trim() || void 0 : void 0;
 }
 //#endregion
+//#region extensions/codex/src/app-server/client-fork-settings.ts
+const clients = defineCodexBuildState("openclaw.codexClientForkSettings", () => /* @__PURE__ */ new WeakMap())();
+/** The physical client owner initializes and disposes these nonpersistent snapshots. */
+function initializeCodexClientForkSettings(client) {
+	clients.set(client, /* @__PURE__ */ new Map());
+}
+function forgetCodexClientForkSettings(client, threadId) {
+	if (threadId === void 0) clients.delete(client);
+	else clients.get(client)?.delete(threadId);
+}
+function recordCodexThreadForkSettings(client, threadId, params) {
+	const settings = clients.get(client);
+	if (!settings || settings.has(threadId)) return;
+	const permissions = typeof params.permissions === "string" ? params.permissions : void 0;
+	const thread = {
+		threadId,
+		...params.model !== void 0 ? { model: params.model } : {},
+		...params.modelProvider !== void 0 ? { modelProvider: params.modelProvider } : {},
+		...params.cwd !== void 0 ? { cwd: params.cwd } : {},
+		...params.runtimeWorkspaceRoots !== void 0 ? { runtimeWorkspaceRoots: params.runtimeWorkspaceRoots } : {},
+		...params.approvalPolicy !== void 0 ? { approvalPolicy: params.approvalPolicy } : {},
+		...params.approvalsReviewer !== void 0 ? { approvalsReviewer: params.approvalsReviewer } : {},
+		...params.sandbox !== void 0 ? { sandbox: params.sandbox } : {},
+		...permissions !== void 0 ? { permissions } : {},
+		...params.serviceTier !== void 0 ? { serviceTier: params.serviceTier } : {},
+		...params.config !== void 0 ? { config: params.config } : {},
+		...params.developerInstructions !== void 0 ? { developerInstructions: params.developerInstructions } : {}
+	};
+	settings.set(threadId, { thread });
+}
+function recordCodexTurnForkSettings(client, params) {
+	const settings = clients.get(client)?.get(params.threadId);
+	if (settings) settings.turn = {
+		additionalContext: params.additionalContext,
+		cwd: params.cwd,
+		runtimeWorkspaceRoots: params.runtimeWorkspaceRoots,
+		model: params.model,
+		approvalPolicy: params.approvalPolicy,
+		approvalsReviewer: params.approvalsReviewer,
+		sandboxPolicy: params.sandboxPolicy,
+		serviceTier: params.serviceTier,
+		effort: params.effort,
+		personality: params.personality,
+		environments: params.environments,
+		collaborationMode: params.collaborationMode
+	};
+}
+function requireCodexThreadForkSettings(client, threadId) {
+	const settings = clients.get(client)?.get(threadId);
+	if (!settings?.turn) throw new Error("Cache-parity session fork requires a parent turn prepared by this OpenClaw runtime. Send a normal message first.");
+	return {
+		...settings,
+		turn: settings.turn
+	};
+}
+//#endregion
 //#region extensions/codex/src/app-server/client-thread-owner.ts
 function createThreadOwnerToken(threadId, onInvalidated) {
 	const owner = {
@@ -1627,8 +1574,12 @@ function revertRetainedThreadInstructions(runtime, threadId) {
 		refreshableInstructions: retained.ephemeralPolicy.nativeRefreshableInstructions
 	};
 }
-function createCodexEphemeralThreadPolicy({ developerInstructions, refreshableInstructions }) {
+function createCodexEphemeralThreadPolicy({ developerInstructions, refreshableInstructions, config }, nativeConfig) {
+	const limit = config?.model_auto_compact_token_limit ?? nativeConfig?.model_auto_compact_token_limit;
+	const scope = config?.model_auto_compact_token_limit_scope ?? nativeConfig?.model_auto_compact_token_limit_scope ?? "total";
 	return {
+		...typeof limit === "number" ? { autoCompactTokenLimit: limit } : {},
+		...typeof scope === "string" ? { autoCompactTokenLimitScope: scope } : {},
 		developerInstructions,
 		refreshableInstructions,
 		nativeRefreshableInstructions: refreshableInstructions
@@ -1707,12 +1658,11 @@ const rateLimitsByClient = defineCodexBuildState("openclaw.codexAppServerRateLim
 /** Replaces one physical client's cache with an authoritative rate-limit read response. */
 function rememberCodexRateLimitsRead(client, value, nowMs = Date.now()) {
 	if (value !== void 0) {
-		const revisionsByLimitId = { ...rateLimitsByClient.get(client)?.revisionsByLimitId };
-		for (const limitId of readRateLimitIds(value)) revisionsByLimitId[limitId] = (revisionsByLimitId[limitId] ?? 0) + 1;
+		const currentState = rateLimitsByClient.get(client);
 		rateLimitsByClient.set(client, {
 			value,
 			updatedAtMs: nowMs,
-			revisionsByLimitId
+			revision: (currentState?.revision ?? 0) + Number(hasCodexRateLimit(value))
 		});
 	}
 }
@@ -1726,15 +1676,12 @@ function mergeCodexRateLimitsUpdate(client, value, nowMs = Date.now()) {
 	rateLimitsByClient.set(client, {
 		value: mergeRateLimitUpdate(current, update),
 		updatedAtMs: nowMs,
-		revisionsByLimitId: {
-			...currentState?.revisionsByLimitId,
-			[limitId]: (currentState?.revisionsByLimitId[limitId] ?? 0) + 1
-		}
+		revision: (currentState?.revision ?? 0) + Number(limitId === "codex")
 	});
 }
-/** Per-limit marker used to trust only primary Codex updates from one turn startup. */
-function readCodexRateLimitsRevision(client, limitId = "codex") {
-	return rateLimitsByClient.get(client)?.revisionsByLimitId[limitId] ?? 0;
+/** Marker used to trust only primary Codex updates from one turn startup. */
+function readCodexRateLimitsRevision(client) {
+	return rateLimitsByClient.get(client)?.revision ?? 0;
 }
 /** Reads one physical client's cached rate-limit payload within the max-age window. */
 function readRecentCodexRateLimits(client, options) {
@@ -1775,15 +1722,13 @@ function mergeRateLimitUpdate(current, update) {
 		...nextByLimitId ? { rateLimitsByLimitId: nextByLimitId } : {}
 	};
 }
-function readRateLimitIds(value) {
-	if (!isJsonObject(value)) return [];
-	const ids = /* @__PURE__ */ new Set();
-	if (isJsonObject(value.rateLimits)) ids.add(readLimitId(value.rateLimits));
-	if (isJsonObject(value.rateLimitsByLimitId)) for (const [key, snapshot] of Object.entries(value.rateLimitsByLimitId)) {
-		const snapshotLimitId = isJsonObject(snapshot) && typeof snapshot.limitId === "string" ? snapshot.limitId.trim() : "";
-		ids.add(snapshotLimitId || key);
-	}
-	return [...ids];
+function hasCodexRateLimit(value) {
+	if (!isJsonObject(value)) return false;
+	if (isJsonObject(value.rateLimits) && readLimitId(value.rateLimits) === "codex") return true;
+	if (!isJsonObject(value.rateLimitsByLimitId)) return false;
+	return Object.entries(value.rateLimitsByLimitId).some(([key, snapshot]) => {
+		return ((isJsonObject(snapshot) && typeof snapshot.limitId === "string" ? snapshot.limitId.trim() : "") || key) === "codex";
+	});
 }
 function readLimitId(snapshot) {
 	const value = snapshot.limitId;
@@ -1832,7 +1777,7 @@ async function readCodexClientSessionMeta(client, sessionsRoot, boundRolloutPath
 	return readCodexWorkspaceSessionMeta(client, configuredClients.get(client), sessionsRoot, boundRolloutPath, threadId, CODEX_APP_SERVER_LIVE_THREAD_MAX_IDLE);
 }
 /** Installs one auth-refresh handler and one rate-limit observer per physical client. */
-function ensureCodexAppServerClientRuntime(client, context) {
+function ensureCodexAppServerClientRuntime(client, context, onThreadOwnershipChange) {
 	const existing = configuredClients.get(client);
 	if (existing) {
 		if (existing.closed) return;
@@ -1844,6 +1789,7 @@ function ensureCodexAppServerClientRuntime(client, context) {
 	}
 	const runtime = {
 		context,
+		onThreadOwnershipChange,
 		closed: false,
 		retainedThreads: /* @__PURE__ */ new Map(),
 		claimedThreads: /* @__PURE__ */ new Map(),
@@ -1853,6 +1799,7 @@ function ensureCodexAppServerClientRuntime(client, context) {
 		workspaceReferences: /* @__PURE__ */ new Map()
 	};
 	configuredClients.set(client, runtime);
+	initializeCodexClientForkSettings(client);
 	client.addCloseHandler(() => {
 		runtime.closed = true;
 		clearTimeout(runtime.evictionTimer);
@@ -1865,6 +1812,7 @@ function ensureCodexAppServerClientRuntime(client, context) {
 		runtime.protectedThreads.clear();
 		runtime.sessionMetadata.clear();
 		runtime.workspaceReferences.clear();
+		forgetCodexClientForkSettings(client);
 	});
 	client.addRequestHandler(async (request) => {
 		if (request.method !== "account/chatgptAuthTokens/refresh") return;
@@ -1910,16 +1858,18 @@ function ensureCodexAppServerClientRuntime(client, context) {
 			if (typeof threadId === "string") {
 				invalidateThreadOwnership(runtime, threadId);
 				runtime.sessionMetadata.delete(threadId);
+				forgetCodexClientForkSettings(client, threadId);
 				runtime.workspaceReferences.delete(threadId);
-				scheduleRetainedThreadEviction(client, runtime);
+				updateThreadOwnership(client, runtime);
 			}
 		}
 	});
 }
-function scheduleRetainedThreadEviction(client, runtime) {
+function updateThreadOwnership(client, runtime) {
 	clearTimeout(runtime.evictionTimer);
 	runtime.evictionTimer = void 0;
 	if (runtime.closed) return;
+	runtime.onThreadOwnershipChange?.();
 	let expiresAt = Number.POSITIVE_INFINITY;
 	for (const [threadId, thread] of runtime.retainedThreads) if (!runtime.protectedThreads.has(threadId)) expiresAt = Math.min(expiresAt, thread.expiresAt);
 	if (!Number.isFinite(expiresAt)) return;
@@ -1928,7 +1878,7 @@ function scheduleRetainedThreadEviction(client, runtime) {
 		evictExpiredRetainedThreads(client, runtime).catch((error) => {
 			embeddedAgentLog$1.warn("codex retained thread expiry failed", { reason: formatErrorMessage$1(error) });
 		});
-	}, Math.max(0, expiresAt - Date.now()));
+	}, Math.max(0, Math.floor(expiresAt - performance.now())));
 	runtime.evictionTimer.unref?.();
 }
 async function releaseRetainedThread(client, runtime, threadId, assertCurrent, withCurrent) {
@@ -1940,13 +1890,7 @@ async function releaseRetainedThread(client, runtime, threadId, assertCurrent, w
 	}
 	const retained = runtime.retainedThreads.get(threadId);
 	if (!retained) return false;
-	const olderThreadIds = /* @__PURE__ */ new Set();
-	for (const candidateThreadId of runtime.retainedThreads.keys()) {
-		if (candidateThreadId === threadId) break;
-		olderThreadIds.add(candidateThreadId);
-	}
 	runtime.retainedThreads.delete(threadId);
-	scheduleRetainedThreadEviction(client, runtime);
 	const transition = {
 		retainedOwnerToken: retained.ownerToken,
 		completion: Promise.resolve().then(() => {
@@ -1955,29 +1899,28 @@ async function releaseRetainedThread(client, runtime, threadId, assertCurrent, w
 		})
 	};
 	runtime.releasingThreads.set(threadId, transition);
+	updateThreadOwnership(client, runtime);
 	try {
 		await transition.completion;
 		runtime.workspaceReferences.delete(threadId);
+		forgetCodexClientForkSettings(client, threadId);
 		retained.ownerToken?.invalidate();
 		return true;
 	} catch (error) {
 		if (!runtime.closed && !transition.invalidated && runtime.releasingThreads.get(threadId) === transition && !runtime.retainedThreads.has(threadId) && !runtime.claimedThreads.has(threadId)) {
-			if (retained.ephemeralPolicy === void 0) retained.expiresAt = Date.now() + CODEX_APP_SERVER_LIVE_THREAD_IDLE_TIMEOUT_MS;
-			const newerThreads = [...runtime.retainedThreads.entries()].filter(([candidateThreadId]) => !olderThreadIds.has(candidateThreadId));
-			for (const [candidateThreadId] of newerThreads) runtime.retainedThreads.delete(candidateThreadId);
+			if (retained.ephemeralPolicy === void 0) retained.expiresAt = performance.now() + CODEX_APP_SERVER_LIVE_THREAD_IDLE_TIMEOUT_MS;
 			runtime.retainedThreads.set(threadId, retained);
-			for (const [candidateThreadId, newerThread] of newerThreads) runtime.retainedThreads.set(candidateThreadId, newerThread);
 		}
 		throw error;
 	} finally {
 		if (runtime.releasingThreads.get(threadId) === transition) runtime.releasingThreads.delete(threadId);
-		scheduleRetainedThreadEviction(client, runtime);
+		updateThreadOwnership(client, runtime);
 	}
 }
 async function evictExpiredRetainedThreads(client, runtime) {
-	const now = Date.now();
+	const now = performance.now();
 	for (const [threadId, thread] of runtime.retainedThreads) if (thread.expiresAt <= now && !runtime.protectedThreads.has(threadId)) await releaseRetainedThread(client, runtime, threadId);
-	scheduleRetainedThreadEviction(client, runtime);
+	updateThreadOwnership(client, runtime);
 }
 async function evictExcessIdleThreads(client, runtime) {
 	const idleThreads = () => [...runtime.retainedThreads].filter(([threadId, thread]) => thread.ephemeralPolicy === void 0 && !runtime.protectedThreads.has(threadId));
@@ -2006,7 +1949,7 @@ async function retainCodexAppServerLiveThread(client, threadId, releaseThread, c
 		configFingerprint,
 		ephemeralPolicy,
 		serviceTier,
-		expiresAt: ephemeralPolicy === void 0 ? Date.now() + CODEX_APP_SERVER_LIVE_THREAD_IDLE_TIMEOUT_MS : Number.POSITIVE_INFINITY,
+		expiresAt: ephemeralPolicy === void 0 ? performance.now() + CODEX_APP_SERVER_LIVE_THREAD_IDLE_TIMEOUT_MS : Number.POSITIVE_INFINITY,
 		release: (releaseThread ? physicalThreadReleases.get(releaseThread) ?? releaseThread : void 0) ?? defaultThreadRelease(client)
 	};
 	runtime.retainedThreads.set(threadId, retained);
@@ -2015,7 +1958,7 @@ async function retainCodexAppServerLiveThread(client, threadId, releaseThread, c
 		await evictExcessIdleThreads(client, runtime);
 	} catch (error) {
 		if (runtime.retainedThreads.get(threadId) === retained) runtime.retainedThreads.delete(threadId);
-		scheduleRetainedThreadEviction(client, runtime);
+		updateThreadOwnership(client, runtime);
 		embeddedAgentLog$1.warn("codex retained thread capacity eviction failed", {
 			threadId,
 			reason: formatErrorMessage$1(error)
@@ -2024,9 +1967,12 @@ async function retainCodexAppServerLiveThread(client, threadId, releaseThread, c
 	}
 	if (runtime.closed) return false;
 	if (claimed !== void 0 && runtime.claimedThreads.get(threadId) === claimed) runtime.claimedThreads.delete(threadId);
-	scheduleRetainedThreadEviction(client, runtime);
+	updateThreadOwnership(client, runtime);
 	return true;
 }
+function readCodexLiveThreadEphemeralPolicy(client, threadId) {
+	return configuredClients.get(client)?.retainedThreads.get(threadId)?.ephemeralPolicy;
+}
 /** Transfer one idle subscription to its next turn or compaction without touching sibling threads. */
 async function consumeCodexAppServerLiveThread(client, threadId, configFingerprint) {
 	const runtime = configuredClients.get(client);
@@ -2050,7 +1996,7 @@ async function claimCodexAppServerLiveThread(client, threadId, onInvalidated) {
 		return;
 	}
 	return claimCodexAppServerThreadOwnership(client, runtime, threadId, runtime.retainedThreads.get(threadId) ?? {
-		expiresAt: Date.now() + CODEX_APP_SERVER_LIVE_THREAD_IDLE_TIMEOUT_MS,
+		expiresAt: performance.now() + CODEX_APP_SERVER_LIVE_THREAD_IDLE_TIMEOUT_MS,
 		release: defaultThreadRelease(client)
 	}, onInvalidated);
 }
@@ -2061,7 +2007,7 @@ function claimCodexAppServerThreadOwnership(client, runtime, threadId, retained,
 	runtime.claimedThreads.set(threadId, claimed);
 	previousClaim?.invalidate();
 	retained.ownerToken?.invalidate();
-	scheduleRetainedThreadEviction(client, runtime);
+	updateThreadOwnership(client, runtime);
 	const assertCurrent = () => {
 		if (claimed.invalidated || runtime.closed || runtime.claimedThreads.get(threadId) !== claimed) throw new Error(`Codex thread subscription ownership changed: ${threadId}`);
 	};
@@ -2102,10 +2048,12 @@ function claimCodexAppServerThreadOwnership(client, runtime, threadId, retained,
 			if (runtime.claimedThreads.get(threadId) === claimed) {
 				runtime.claimedThreads.delete(threadId);
 				runtime.workspaceReferences.delete(threadId);
+				forgetCodexClientForkSettings(client, threadId);
 				claimed.invalidate();
 			}
 		} finally {
 			if (runtime.releasingThreads.get(threadId) === transition) runtime.releasingThreads.delete(threadId);
+			updateThreadOwnership(client, runtime);
 		}
 	};
 	physicalThreadReleases.set(release, retained.release);
@@ -2119,7 +2067,8 @@ function claimCodexAppServerThreadOwnership(client, runtime, threadId, retained,
 		forget: () => {
 			if (forgetThreadOwnership(runtime, threadId, claimed)) {
 				runtime.workspaceReferences.delete(threadId);
-				scheduleRetainedThreadEviction(client, runtime);
+				forgetCodexClientForkSettings(client, threadId);
+				updateThreadOwnership(client, runtime);
 			}
 		}
 	};
@@ -2129,6 +2078,11 @@ function revertCodexAppServerLiveThreadInstructions(client, threadId) {
 	const runtime = configuredClients.get(client);
 	if (runtime && !runtime.closed) revertRetainedThreadInstructions(runtime, threadId);
 }
+/** Native subscriptions, including ephemeral history and releases, pin their physical client. */
+function hasCodexAppServerThreadOwnership(client) {
+	const runtime = configuredClients.get(client);
+	return Boolean(runtime && !runtime.closed && (runtime.retainedThreads.size > 0 || runtime.claimedThreads.size > 0 || runtime.releasingThreads.size > 0 || runtime.protectedThreads.size > 0));
+}
 /** Distinguish active claimed ownership from an already-evicted idle subscription. */
 function hasCodexAppServerLiveThread(client, threadId) {
 	return hasThreadOwnership(configuredClients.get(client), threadId);
@@ -2169,6 +2123,7 @@ async function unsubscribeCodexAppServerLiveThread(client, threadId, timeoutMs,
 		});
 		assertCurrent?.();
 		runtime?.workspaceReferences.delete(threadId);
+		forgetCodexClientForkSettings(client, threadId);
 	});
 	const ownsTransition = runtime !== void 0 && transition === void 0;
 	if (transition) transition.physicalRelease = physicalRelease;
@@ -2178,20 +2133,24 @@ async function unsubscribeCodexAppServerLiveThread(client, threadId, timeoutMs,
 			physicalRelease
 		};
 		runtime.releasingThreads.set(threadId, transition);
+		updateThreadOwnership(client, runtime);
 	}
 	try {
 		await physicalRelease;
 		if (retained !== void 0 && runtime?.retainedThreads.get(threadId) === retained) {
 			runtime.retainedThreads.delete(threadId);
 			retained.ownerToken?.invalidate();
-			scheduleRetainedThreadEviction(client, runtime);
+			updateThreadOwnership(client, runtime);
 		}
 		if (claimed !== void 0 && runtime?.claimedThreads.get(threadId) === claimed) {
 			runtime.claimedThreads.delete(threadId);
 			claimed.invalidate();
 		}
 	} finally {
-		if (ownsTransition && runtime.releasingThreads.get(threadId) === transition) runtime.releasingThreads.delete(threadId);
+		if (ownsTransition && runtime.releasingThreads.get(threadId) === transition) {
+			runtime.releasingThreads.delete(threadId);
+			updateThreadOwnership(client, runtime);
+		}
 	}
 }
 /** Reset/end owns the exact thread; failed generation retirement must never release its successor. */
@@ -2204,7 +2163,7 @@ function protectCodexAppServerLiveThread(client, threadId) {
 	const runtime = configuredClients.get(client);
 	if (!runtime || runtime.closed) return () => void 0;
 	runtime.protectedThreads.set(threadId, (runtime.protectedThreads.get(threadId) ?? 0) + 1);
-	scheduleRetainedThreadEviction(client, runtime);
+	updateThreadOwnership(client, runtime);
 	let protectedThread = true;
 	return () => {
 		if (!protectedThread) return;
@@ -2213,12 +2172,12 @@ function protectCodexAppServerLiveThread(client, threadId) {
 		if (releaseThreadProtection(runtime, threadId)) {
 			const retained = runtime.retainedThreads.get(threadId);
 			if (retained) {
-				if (retained.ephemeralPolicy === void 0) retained.expiresAt = Date.now() + CODEX_APP_SERVER_LIVE_THREAD_IDLE_TIMEOUT_MS;
+				if (retained.ephemeralPolicy === void 0) retained.expiresAt = performance.now() + CODEX_APP_SERVER_LIVE_THREAD_IDLE_TIMEOUT_MS;
 				runtime.retainedThreads.delete(threadId);
 				runtime.retainedThreads.set(threadId, retained);
 			}
 		}
-		scheduleRetainedThreadEviction(client, runtime);
+		updateThreadOwnership(client, runtime);
 		evictExcessIdleThreads(client, runtime).catch((error) => {
 			embeddedAgentLog$1.warn("codex retained thread unpin eviction failed", {
 				threadId,
@@ -2380,7 +2339,7 @@ function ownCodexInferenceClient(client, startOptions = {}, oauth) {
 	};
 	client.addCloseHandler(close);
 	client.addNotificationHandler((notification) => {
-		if (notification.method === "thread/closed" && isJsonObject(notification.params) && typeof notification.params.threadId === "string") owner.threads.delete(notification.params.threadId);
+		if ((notification.method === "thread/closed" || notification.method === "thread/archived" || notification.method === "thread/deleted") && isJsonObject(notification.params) && typeof notification.params.threadId === "string") forgetCodexInferenceThread(client, notification.params.threadId);
 		if (notification.method !== "account/updated" || !owner.authRoute) return;
 		const mode = isJsonObject(notification.params) ? notification.params.authMode : void 0;
 		if ((mode === "apiKey" ? "apiKey" : mode === "chatgpt" || mode === "chatgptAuthTokens" ? "chatgpt" : void 0) !== owner.authRoute) close();
@@ -2485,9 +2444,9 @@ async function prepareCodexInferenceRoute(params) {
 				throw new Error("Codex inference route limit reached; start a fresh managed native connection before retrying.");
 			}
 			pending = Promise.all([
-				import("./inference-proxy-BDWV0djM.mjs"),
-				import("./native-subagent-monitor-DOLEIf9r.mjs").then((n) => n.n),
-				import("./inference-dispatch-CO6tTs4q.mjs")
+				import("./inference-proxy-yd3hr2dr.mjs"),
+				import("./native-subagent-monitor-CFE7b4oC.mjs").then((n) => n.n),
+				import("./inference-dispatch-C2zVSnrr.mjs")
 			]).then(([{ createCodexInferenceProxy }, native, { createCodexInferenceModelBinding }]) => {
 				assertClient();
 				return createCodexInferenceProxy({
@@ -2636,7 +2595,7 @@ function bindCodexInferenceThread(client, threadId, route, providers) {
 	if (!owner && !route) return;
 	if (!owner || owner.closed) throw new Error("Codex inference client is closed");
 	if (!route) {
-		owner.threads.delete(threadId);
+		forgetCodexInferenceThread(client, threadId);
 		return;
 	}
 	route.assertCurrent();
@@ -2661,12 +2620,19 @@ function bindCodexInferenceThread(client, threadId, route, providers) {
 			return projectedRoute !== void 0 && owner.handles.get(projectedRoute)?.modelPolicyEnforced === true;
 		}
 	}) : void 0;
+	const previous = owner.threads.get(threadId)?.route;
+	if (previous && previous !== route) previous.context.forget(threadId);
 	owner.threads.set(threadId, {
 		route,
 		providers: projected,
 		qualification
 	});
 }
+function forgetCodexInferenceThread(client, threadId) {
+	const owner = owners.get(client);
+	owner?.threads.get(threadId)?.route.context.forget(threadId);
+	owner?.threads.delete(threadId);
+}
 function getCodexInferenceThread(client, threadId) {
 	const owner = owners.get(client);
 	if (owner?.closed) throw new Error("Codex inference client is closed");
@@ -2679,52 +2645,24 @@ function getCodexInferenceThreadQualification(client, threadId) {
 	return owner?.threads.get(threadId)?.qualification;
 }
 //#endregion
-//#region extensions/codex/src/app-server/native-config-fence.ts
-/** Serializes this Gateway's native config writes with its config-loading requests. */
-const CODEX_NATIVE_CONFIG_FENCE_STATE = Symbol.for("openclaw.codexNativeConfigFenceState");
-/** Acquires the per-CODEX_HOME fence and returns an idempotent release. */
-async function acquireCodexNativeConfigFence(key, options = {}) {
-	const state = resolveGlobalMap(CODEX_NATIVE_CONFIG_FENCE_STATE);
-	const previous = state.get(key) ?? Promise.resolve();
-	const { promise: current, resolve: resolveCurrent } = createDeferred();
-	state.set(key, current);
-	let released = false;
-	const release = () => {
-		if (released) return;
-		released = true;
-		resolveCurrent();
-		if (state.get(key) === current) state.delete(key);
-	};
-	try {
-		await waitForPreviousFence(previous, options);
-	} catch (error) {
-		previous.then(release);
-		throw error;
-	}
-	return release;
+//#region extensions/codex/src/app-server/managed-fallback.ts
+function isCodexComputerUseCandidateArtifactsUnavailableError(error) {
+	return error !== null && typeof error === "object" && "code" in error && error.code === "CODEX_COMPUTER_USE_CANDIDATE_ARTIFACTS_UNAVAILABLE";
 }
-async function waitForPreviousFence(previous, options) {
-	if (options.signal?.aborted) throw new Error(options.abortMessage ?? "Codex native config fence aborted");
-	if (options.timeoutMs === void 0 && !options.signal) {
-		await previous;
-		return;
-	}
-	await new Promise((resolve, reject) => {
-		let timeout;
-		const settle = (error) => {
-			clearTimeout(timeout);
-			timeout = void 0;
-			options.signal?.removeEventListener("abort", onAbort);
-			return error ? reject(error) : resolve();
+function resolveManagedFallbackStartOptions(startOptions) {
+	const commands = [startOptions.command, ...startOptions.managedFallbackCommandPaths ?? []];
+	const candidates = [];
+	for (const [index, command] of commands.entries()) {
+		const managedFallbackCommandPaths = commands.slice(index + 1);
+		const candidate = {
+			...startOptions,
+			command
 		};
-		const onAbort = () => settle(new Error(options.abortMessage ?? "Codex native config fence aborted"));
-		previous.then(() => settle());
-		options.signal?.addEventListener("abort", onAbort, { once: true });
-		if (options.timeoutMs !== void 0) {
-			timeout = setTimeout(() => settle(new Error(options.timeoutMessage ?? "Codex native config fence timed out")), Math.max(1, options.timeoutMs));
-			timeout.unref?.();
-		}
-	});
+		if (managedFallbackCommandPaths.length === 0) delete candidate.managedFallbackCommandPaths;
+		else candidate.managedFallbackCommandPaths = managedFallbackCommandPaths;
+		candidates.push(candidate);
+	}
+	return candidates;
 }
 //#endregion
 //#region extensions/codex/src/app-server/native-hook-relay-state.ts
@@ -2763,6 +2701,38 @@ const nativeHookRelayUnregisterQueue = {
 	}
 };
 //#endregion
+//#region extensions/codex/src/app-server/shared-client-key.ts
+/** Cache keys that decide which acquisitions share one physical Codex app-server client. */
+/**
+* Returns the shared-client key for start options under one acquisition's
+* auth identity, desktop generation, and runtime-artifact mode. Callers key
+* their resolved start options, and rekey after a managed fallback.
+*/
+function createSharedCodexAppServerClientKeyResolver(params) {
+	const { preparedAuth, authRequirement, authProfileId, desktopGeneration } = params;
+	const authIdentityCacheKey = preparedAuth?.kind === "api-key" ? resolveCodexAppServerPreparedApiKeyCacheKey(preparedAuth.apiKey) : preparedAuth?.snapshot.secretFreeCacheKey ?? ((authRequirement === "api-key" || authRequirement === "environment-api-key") && !authProfileId ? resolveCodexAppServerFallbackApiKeyCacheKey({
+		startOptions: params.startOptions,
+		allowNativeAuthFile: authRequirement === "api-key"
+	}) : void 0);
+	const expectedRuntimeArtifactKey = params.expectedRuntimeArtifact ? createHash("sha256").update(params.expectedRuntimeArtifact.id).update("\0").update(params.expectedRuntimeArtifact.fingerprint).digest("hex") : "mint";
+	return (startOptions) => {
+		const baseKey = `${codexAppServerStartOptionsKey(startOptions, {
+			authProfileId,
+			authBindingFingerprint: params.authBindingFingerprint,
+			agentDir: params.usesNativeAuth ? void 0 : params.agentDir,
+			fallbackApiKeyCacheKey: authIdentityCacheKey
+		})}\0auth-requirement:${authRequirement ?? "native"}${desktopGeneration ? `\0desktop-generation:${desktopGeneration.epoch}` : ""}`;
+		return params.runtimeArtifactMode ? `${baseKey}\0runtime-artifact:capture-v1:${expectedRuntimeArtifactKey}` : baseKey;
+	};
+}
+//#endregion
+//#region extensions/codex/src/app-server/shared-client-start-policy.ts
+function shouldTrackDesktopGeneration(startOptions, pluginConfig) {
+	if (startOptions.transport !== "stdio") return false;
+	if (resolveCodexComputerUseConfig({ pluginConfig }).enabled && (startOptions.commandSource === "managed" || startOptions.commandSource === "resolved-managed")) return true;
+	return startOptions.commandSource === "managed" && (startOptions.managedCommandOrder ?? "package-first") === "desktop-first";
+}
+//#endregion
 //#region extensions/codex/src/app-server/spawn-identity.ts
 /** Resolves non-secret spawn identity before startup; argv is represented only by its hash. */
 function resolveCodexAppServerSpawnIdentity(startOptions, resolvedNativeCommand) {
@@ -2777,12 +2747,6 @@ function resolveCodexAppServerSpawnIdentity(startOptions, resolvedNativeCommand)
 }
 //#endregion
 //#region extensions/codex/src/app-server/thread-lifecycle-errors.ts
-const CODEX_APP_SERVER_CONTEXT_RESTART_SELECTION_CHANGED = "CODEX_APP_SERVER_CONTEXT_RESTART_SELECTION_CHANGED";
-/** True when a pre-write context restart must replay on the newly selected owner. */
-function isCodexContextRestartSelectionChangedError(error) {
-	const cause = codexPrewriteRejectionCause(error);
-	return cause instanceof Error && "code" in cause && cause.code === "CODEX_APP_SERVER_CONTEXT_RESTART_SELECTION_CHANGED";
-}
 var CodexThreadStartRequestError = class extends Error {
 	constructor(cause) {
 		super(`thread/start: ${formatErrorMessage$1(cause)}`, { cause });
@@ -2810,30 +2774,24 @@ var CodexAdoptedThreadActiveError = class extends AgentHarnessPreflightError$1 {
 //#endregion
 //#region extensions/codex/src/app-server/shared-client.ts
 var shared_client_exports = /* @__PURE__ */ __exportAll({
-	assertCodexAppServerClientStartSelectionCurrent: () => assertCodexAppServerClientStartSelectionCurrent,
 	captureCodexAppServerClientLifetime: () => captureCodexAppServerClientLifetime,
 	captureSharedCodexAppServerCatalogLifetime: () => captureSharedCodexAppServerCatalogLifetime,
 	clearSharedCodexAppServerClientAndWait: () => clearSharedCodexAppServerClientAndWait,
-	clearSharedCodexAppServerClientIfCurrent: () => clearSharedCodexAppServerClientIfCurrent,
 	clearSharedCodexAppServerClientIfCurrentAndUnclaimed: () => clearSharedCodexAppServerClientIfCurrentAndUnclaimed,
 	clearSharedCodexAppServerClientIfCurrentAndWait: () => clearSharedCodexAppServerClientIfCurrentAndWait,
 	createIsolatedCodexAppServerClient: () => createIsolatedCodexAppServerClient,
 	getLeasedSharedCodexAppServerClient: () => getLeasedSharedCodexAppServerClient,
 	getSharedCodexAppServerClient: () => getSharedCodexAppServerClient,
-	isCodexAppServerStartSelectionChangedError: () => isCodexAppServerStartSelectionChangedError,
 	readCodexAppServerClientDesktopGeneration: () => readCodexAppServerClientDesktopGeneration,
 	readCodexAppServerClientDesktopGenerationFingerprint: () => readCodexAppServerClientDesktopGenerationFingerprint,
 	readCodexAppServerClientProcessIdentity: () => readCodexAppServerClientProcessIdentity,
 	releaseCodexAppServerClientLease: () => releaseCodexAppServerClientLease,
 	releaseLeasedSharedCodexAppServerClient: () => releaseLeasedSharedCodexAppServerClient,
-	resolveCodexNativeConfigFenceKey: () => resolveCodexNativeConfigFenceKey,
 	retainSharedCodexAppServerClientIfCurrent: () => retainSharedCodexAppServerClientIfCurrent,
 	retireSharedCodexAppServerClientIfCurrent: () => retireSharedCodexAppServerClientIfCurrent,
-	waitForCodexAppServerClientDesktopGenerationDrain: () => waitForCodexAppServerClientDesktopGenerationDrain,
-	withLeasedCodexAppServerClientStartSelectionRetry: () => withLeasedCodexAppServerClientStartSelectionRetry
+	withCodexAppServerClientRequestScope: () => withCodexAppServerClientRequestScope
 });
 const SHARED_CODEX_APP_SERVER_CLIENT_DISPOSER = codexBuildSymbol("openclaw.codexAppServerClientDisposer");
-const CODEX_APP_SERVER_INITIALIZE_TIMEOUT_MESSAGE = "codex app-server initialize timed out";
 async function prepareCodexAppServerClient(options) {
 	const lifetime = getSharedCodexAppServerClientState().startup;
 	const abandonSignal = options?.abandonSignal ? AbortSignal.any([lifetime.controller.signal, options.abandonSignal]) : lifetime.controller.signal;
@@ -2844,7 +2802,7 @@ async function prepareCodexAppServerClient(options) {
 	const startedAt = performance.now();
 	observeAcquire(options, { boundary: "context" });
 	return {
-		context: await withCodexAppServerAcquireDeadline(options?.timeoutMs ?? 0, ownCodexStartup(lifetime, resolveCodexAppServerClientStartContext(options)), abandonSignal),
+		context: await withCodexAppServerAcquireDeadline(options?.timeoutMs ?? 0, ownCodexStartup(lifetime, resolveCodexAppServerClientStartContext(options, startedAt)), abandonSignal),
 		lifetime,
 		abandonSignal,
 		startedAt,
@@ -2869,59 +2827,7 @@ function readCodexAppServerClientDesktopGenerationFingerprint(client) {
 function readCodexAppServerClientDesktopGeneration(client) {
 	return getSharedCodexAppServerClientState().startMetadata.get(client)?.desktopGeneration;
 }
-/** Waits until older physical desktop clients for this client's Codex home exit. */
-async function waitForCodexAppServerClientDesktopGenerationDrain(params) {
-	const metadata = getSharedCodexAppServerClientState().startMetadata.get(params.client);
-	if (!metadata?.desktopGeneration) return;
-	const drain = createOlderDesktopGenerationDrainWait({
-		generation: metadata.desktopGeneration,
-		startOptions: metadata.startOptions,
-		agentDir: metadata.agentDir
-	});
-	try {
-		await withCodexAppServerAcquireDeadline(params.timeoutMs ?? 0, drain.promise, params.signal, "Codex Computer Use install timed out waiting for older desktop clients");
-	} finally {
-		drain.cancel();
-	}
-}
-var CodexAppServerStartSelectionChangedError = class extends Error {
-	constructor() {
-		super("Codex app-server managed executable selection changed during startup");
-		this.code = "CODEX_APP_SERVER_START_SELECTION_CHANGED";
-		this.name = "CodexAppServerStartSelectionChangedError";
-	}
-};
-/** Cross-bundle-safe check for a managed executable selection retry. */
-function isCodexAppServerStartSelectionChangedError(error) {
-	const cause = codexPrewriteRejectionCause(error);
-	return cause instanceof Error && "code" in cause && cause.code === "CODEX_APP_SERVER_START_SELECTION_CHANGED";
-}
-/**
-* Rechecks mutable Codex-owned plugin state immediately before thread start/resume.
-* The synchronous check prevents another gateway task from installing Computer
-* Use between the check and the JSON-RPC write on the same event loop turn.
-*/
-function assertCodexAppServerClientStartSelectionCurrent(params) {
-	const metadata = getSharedCodexAppServerClientState().startMetadata.get(params.client);
-	if (!metadata) return;
-	if (metadata.desktopGeneration && !isCodexDesktopGenerationCurrent(metadata.desktopGeneration)) throw new CodexAppServerStartSelectionChangedError();
-	const requestedStartOptions = params.startOptions ?? metadata.requestedStartOptions;
-	if (requestedStartOptions.commandSource !== "managed") return;
-	const current = resolveCodexAppServerStartOptionsForAgent({
-		startOptions: requestedStartOptions,
-		agentDir: params.agentDir ?? metadata.agentDir
-	});
-	if ((metadata.startOptions.managedCommandOrder ?? "package-first") !== (current.managedCommandOrder ?? "package-first")) throw new CodexAppServerStartSelectionChangedError();
-}
-function resolveCodexNativeConfigFenceKey(params) {
-	const metadata = params.client ? getSharedCodexAppServerClientState().startMetadata.get(params.client) : void 0;
-	const startOptions = metadata?.startOptions ?? params.startOptions;
-	if (!startOptions || startOptions.transport !== "stdio") return;
-	const configuredHome = startOptions.codexHome ?? startOptions.env?.CODEX_HOME?.trim();
-	const codexHome = configuredHome ? configuredHome : startOptions.homeScope === "user" ? resolveCodexAppServerUserHomeDir() : resolveCodexAppServerHomeDir(params.agentDir ?? metadata?.agentDir ?? resolveDefaultAgentDir(params.config ?? {}));
-	return codexHome ? `codex-home:${path.resolve(codexHome)}` : void 0;
-}
-async function resolveCodexAppServerClientStartContext(options) {
+async function resolveCodexAppServerClientStartContext(options, startedAt) {
 	const requestedStartOptions = options?.startOptions ?? resolveCodexAppServerRuntimeOptions({ pluginConfig: options?.pluginConfig }).start;
 	const agentDir = options?.agentDir ?? (requestedStartOptions.homeScope === "user" ? void 0 : resolveDefaultAgentDir(options?.config ?? {}));
 	const desktopGeneration = shouldTrackDesktopGeneration(requestedStartOptions, options?.pluginConfig) ? await waitForCodexDesktopGeneration() : void 0;
@@ -2936,13 +2842,13 @@ async function resolveCodexAppServerClientStartContext(options) {
 	let authRequirement = options?.authRequirement ?? preparedAuthRequirement;
 	const usesNativeAuth = !preparedAuth && (options?.authProfileId === null || requestedStartOptions.homeScope === "user");
 	const requestedAuthProfileId = preparedAuth?.kind === "profile" ? preparedAuth.profileId : options?.authProfileId ?? void 0;
-	const authProfileStore = preparedAuth?.kind === "profile" ? preparedAuth.store : !usesNativeAuth && preparedAuth?.kind !== "api-key" ? resolveCodexAppServerAuthProfileStore({
+	const authProfileStore = preparedAuth?.kind === "profile" ? preparedAuth.store : !usesNativeAuth && preparedAuth?.kind !== "api-key" ? await resolveCodexAppServerAuthProfileStore({
 		agentDir,
 		authProfileId: requestedAuthProfileId,
 		authProfileStore: options?.authProfileStore,
 		config: options?.config
 	}) : options?.authProfileStore;
-	const authProfileId = preparedAuth?.kind === "profile" ? preparedAuth.profileId : usesNativeAuth || preparedAuth?.kind === "api-key" ? void 0 : resolveCodexAppServerAuthProfileIdForAgent({
+	const authProfileId = preparedAuth?.kind === "profile" ? preparedAuth.profileId : usesNativeAuth || preparedAuth?.kind === "api-key" ? void 0 : await resolveCodexAppServerAuthProfileIdForAgent({
 		authProfileId: requestedAuthProfileId,
 		agentDir,
 		config: options?.config,
@@ -2972,8 +2878,9 @@ async function resolveCodexAppServerClientStartContext(options) {
 		startOptions: requestedStartOptions,
 		agentDir
 	});
+	const remainingMs = resolveRemainingAcquireTimeout(options?.timeoutMs ?? 0, startedAt);
 	const startOptions = await bridgeCodexAppServerStartOptions({
-		startOptions: await resolveManagedCodexAppServerStartOptions(agentStartOptions),
+		startOptions: await resolveManagedCodexAppServerStartOptions(agentStartOptions, { selectionTimeoutMs: remainingMs > 0 ? remainingMs / 2 : void 0 }),
 		agentId: options?.agentId,
 		agentDir,
 		authProfileId: usesNativeAuth || preparedAuth?.kind === "api-key" ? null : authProfileId,
@@ -2996,11 +2903,6 @@ async function resolveCodexAppServerClientStartContext(options) {
 		...desktopGeneration ? { desktopGeneration } : {}
 	};
 }
-function shouldTrackDesktopGeneration(startOptions, pluginConfig) {
-	if (startOptions.transport !== "stdio") return false;
-	if (resolveCodexComputerUseConfig({ pluginConfig }).enabled && (startOptions.commandSource === "managed" || startOptions.commandSource === "resolved-managed")) return true;
-	return startOptions.commandSource === "managed" && (startOptions.managedCommandOrder ?? "package-first") === "desktop-first";
-}
 /** Gets or starts a shared Codex app-server client without retaining a lease. */
 function getSharedCodexAppServerClient(options) {
 	return acquireSharedCodexAppServerClient(options);
@@ -3022,58 +2924,43 @@ function releaseCodexAppServerClientLease(lease) {
 	lease.client = void 0;
 	return client ? releaseLeasedSharedCodexAppServerClient(client) : false;
 }
-/** Retries one config-loading operation with a shared deadline and current client lease. */
-async function withLeasedCodexAppServerClientStartSelectionRetry(params) {
-	let client = params.lease.client;
-	if (!client) throw new Error("Codex app-server selection retry requires an active client lease");
+/** Shares a deadline and live lease check across one operation's requests. */
+async function withCodexAppServerClientRequestScope(params) {
+	const client = params.lease.client;
+	if (!client) throw new Error("Codex app-server request scope requires an active client lease");
 	const timeoutMs = params.options?.timeoutMs ?? 6e4;
 	const deadline = performance.now() + timeoutMs;
 	const signal = params.signal ?? params.options?.abandonSignal;
 	const requestOptions = () => {
-		if (signal?.aborted) throw new CodexAppServerStartupError("aborted", "Codex app-server selection retry aborted");
+		if (signal?.aborted) throw new CodexAppServerStartupError("aborted", "Codex app-server request aborted");
 		const remainingTimeoutMs = deadline - performance.now();
-		if (remainingTimeoutMs <= 0) throw new CodexAppServerStartupError("timed_out", "Codex app-server selection retry timed out");
+		if (remainingTimeoutMs <= 0) throw new CodexAppServerStartupError("timed_out", "Codex app-server request timed out");
 		return {
 			timeoutMs: remainingTimeoutMs,
 			...signal ? { signal } : {}
 		};
 	};
-	for (let attempt = 0; attempt < 2; attempt += 1) {
-		const attemptClient = client;
-		let scopeActive = true;
-		const assertCurrent = () => {
-			if (!scopeActive || params.lease.client !== attemptClient) throw new CodexAppServerStartupError("aborted", "Codex app-server request scope is closed");
-		};
-		try {
-			requestOptions();
-			return await params.run(client, () => {
-				assertCurrent();
-				return {
-					...requestOptions(),
-					assertCurrent
-				};
-			});
-		} catch (error) {
-			if (!isCodexAppServerStartSelectionChangedError(error) || attempt > 0) throw error;
-			retireSharedCodexAppServerClientIfCurrent(client);
-			params.lease.client = void 0;
-			if (!releaseLeasedSharedCodexAppServerClient(client)) {
-				client.close();
-				throw new Error("Codex app-server selection retry requires a leased shared client", { cause: error });
-			}
-			const replacementOptions = requestOptions();
-			client = await getLeasedSharedCodexAppServerClient({
-				...params.options,
-				timeoutMs: replacementOptions.timeoutMs,
-				...signal ? { abandonSignal: signal } : {}
-			});
-			params.lease.client = client;
-			params.onClientChange?.(client);
-		} finally {
-			scopeActive = false;
-		}
+	let scopeActive = true;
+	const assertCurrent = () => {
+		if (!scopeActive || params.lease.client !== client) throw new CodexAppServerStartupError("aborted", "Codex app-server request scope is closed");
+	};
+	try {
+		requestOptions();
+		return await params.run(client, () => {
+			assertCurrent();
+			return {
+				...requestOptions(),
+				assertCurrent,
+				...params.options?.assertCurrentAsync ? { withCurrent: async (write) => {
+					await params.options?.assertCurrentAsync?.();
+					assertCurrent();
+					write();
+				} } : {}
+			};
+		});
+	} finally {
+		scopeActive = false;
 	}
-	throw new Error("Codex app-server selection retry loop exited unexpectedly");
 }
 async function acquireSharedCodexAppServerClient(options, leased = false) {
 	const timeoutMs = options?.timeoutMs ?? 0;
@@ -3084,23 +2971,21 @@ async function acquireSharedCodexAppServerClient(options, leased = false) {
 	const { usesNativeAuth, ...startContext } = context;
 	const { agentDir, authProfileId, authProfileStore, preparedAuth, authRequirement, startOptions, desktopGeneration } = startContext;
 	const remainingTimeoutMs = resolveRemainingAcquireTimeout(timeoutMs, startedAt);
-	const authIdentityCacheKey = preparedAuth?.kind === "api-key" ? resolveCodexAppServerPreparedApiKeyCacheKey(preparedAuth.apiKey) : preparedAuth?.snapshot.secretFreeCacheKey ?? (authRequirement === "api-key" && !authProfileId ? resolveCodexAppServerFallbackApiKeyCacheKey({ startOptions }) : void 0);
-	const baseKey = `${codexAppServerStartOptionsKey(startOptions, {
+	const runtimeArtifactMode = options?.runtimeArtifactMode ?? (options?.expectedRuntimeArtifact ? "capture" : void 0);
+	const keyFor = createSharedCodexAppServerClientKeyResolver({
+		startOptions,
+		agentDir,
 		authProfileId,
 		authBindingFingerprint: options?.authBindingFingerprint,
-		agentDir: usesNativeAuth ? void 0 : agentDir,
-		fallbackApiKeyCacheKey: authIdentityCacheKey
-	})}\0auth-requirement:${authRequirement ?? "native"}${desktopGeneration ? `\0desktop-generation:${desktopGeneration.epoch}` : ""}`;
-	const runtimeArtifactMode = options?.runtimeArtifactMode ?? (options?.expectedRuntimeArtifact ? "capture" : void 0);
-	const expectedRuntimeArtifactKey = options?.expectedRuntimeArtifact ? createHash("sha256").update(options.expectedRuntimeArtifact.id).update("\0").update(options.expectedRuntimeArtifact.fingerprint).digest("hex") : "mint";
-	const key = runtimeArtifactMode ? `${baseKey}\0runtime-artifact:capture-v1:${expectedRuntimeArtifactKey}` : baseKey;
-	let entry = getOrCreateSharedClientEntry(state, key);
-	const existingClient = entry.client;
-	const existingGeneration = existingClient ? state.startMetadata.get(existingClient)?.desktopGeneration : void 0;
-	if (existingClient && existingGeneration && !isCodexDesktopGenerationCurrent(existingGeneration)) {
-		retireSharedCodexAppServerClientIfCurrent(existingClient);
-		entry = getOrCreateSharedClientEntry(state, key);
-	}
+		preparedAuth,
+		authRequirement,
+		usesNativeAuth,
+		desktopGeneration,
+		runtimeArtifactMode,
+		expectedRuntimeArtifact: options?.expectedRuntimeArtifact
+	});
+	const key = keyFor(startOptions);
+	const entry = getOrCreateSharedClientEntry(state, key);
 	entry.startupAbort ??= new AbortController();
 	entry.closeWhenIdle = false;
 	const releasePendingAcquire = retainSharedClientEntry(entry, "pendingAcquires");
@@ -3129,6 +3014,7 @@ async function acquireSharedCodexAppServerClient(options, leased = false) {
 		...startContext,
 		lifetime,
 		entry,
+		onManagedFallback: (fallback) => rekeySharedClientEntry(entry, keyFor(fallback)),
 		authProfileId: usesNativeAuth || preparedAuth?.kind === "api-key" ? null : authProfileId,
 		runtimeArtifactMode,
 		expectedRuntimeArtifact: options?.expectedRuntimeArtifact,
@@ -3156,6 +3042,10 @@ async function acquireSharedCodexAppServerClient(options, leased = false) {
 		retirePendingSharedClientEntryIfUnclaimed(entry);
 		observeAcquire(options, { boundary: "cleanup" });
 		await waitForUnclaimedSharedClientStartup(entry);
+		if (isSharedCodexFallbackJoinError(error)) return acquireSharedCodexAppServerClient({
+			...options,
+			timeoutMs: resolveRemainingAcquireTimeout(timeoutMs, startedAt)
+		}, leased);
 		throw error;
 	} finally {
 		cleanupAbandonSignal?.();
@@ -3163,10 +3053,6 @@ async function acquireSharedCodexAppServerClient(options, leased = false) {
 		releasePendingAcquire();
 	}
 }
-function buildCodexAppServerInitializeTimeoutError(client) {
-	const stderr = client?.getStderrDiagnostic();
-	return new CodexAppServerStartupError("timed_out", stderr ? `${CODEX_APP_SERVER_INITIALIZE_TIMEOUT_MESSAGE}; stderr=${JSON.stringify(stderr)}` : CODEX_APP_SERVER_INITIALIZE_TIMEOUT_MESSAGE);
-}
 function createSharedCodexAppServerClientStartup(params) {
 	const initialized = createDeferred();
 	const ready = ownCodexStartup(params.lifetime, startInitializedCodexAppServerClient({
@@ -3185,7 +3071,6 @@ function createSharedCodexAppServerClientStartup(params) {
 			state.liveClients.add(startedClient);
 			startedClient.addTransportExitHandler((exitedClient) => {
 				state.liveClients.delete(exitedClient);
-				notifyDesktopGenerationDrainChecks(state);
 			});
 			for (const callback of params.entry.onStartedClientCallbacks) callback(startedClient);
 			retirePendingSharedClientEntryIfUnclaimed(params.entry);
@@ -3194,7 +3079,10 @@ function createSharedCodexAppServerClientStartup(params) {
 	}).then((client) => {
 		const state = getSharedCodexAppServerClientState();
 		params.entry.client = client;
+		params.entry.hasOwnedThreads = () => hasCodexAppServerThreadOwnership(client);
 		client.addCloseHandler((closedClient) => {
+			clearTimeout(params.entry.idleTimer);
+			params.entry.idleTimer = void 0;
 			const entry = getCurrentSharedClientEntry(closedClient);
 			if (entry) state.clients.delete(entry.key);
 		});
@@ -3212,6 +3100,7 @@ function createSharedCodexAppServerClientStartup(params) {
 }
 /** Starts a caller-owned client; its assertion never binds ordinary shared-client leases. */
 async function createIsolatedCodexAppServerClient(options) {
+	await options?.assertCurrentAsync?.();
 	options?.assertCurrent?.();
 	const { context, lifetime, abandonSignal, startedAt, assertCurrent } = await prepareCodexAppServerClient(options);
 	assertCurrent();
@@ -3231,13 +3120,13 @@ async function createIsolatedCodexAppServerClient(options) {
 		timeoutMs: resolveRemainingAcquireTimeout(timeoutMs, startedAt),
 		abandonSignal,
 		assertCurrent: options?.assertCurrent,
+		assertCurrentAsync: options?.assertCurrentAsync,
 		onAcquireObservation: options?.onAcquireObservation,
 		onStartedClient: (client) => {
 			const state = getSharedCodexAppServerClientState();
 			state.isolatedClients.add(client);
 			client.addTransportExitHandler((exitedClient) => {
 				state.isolatedClients.delete(exitedClient);
-				notifyDesktopGenerationDrainChecks(state);
 			});
 			options?.onStartedClient?.(client);
 		}
@@ -3257,30 +3146,34 @@ async function startInitializedCodexAppServerClientOnce(params) {
 	const acquireStartedAt = performance.now();
 	const timeoutMs = params.timeoutMs ?? 0;
 	const abandonSignal = params.abandonSignal ? AbortSignal.any([params.lifetime.controller.signal, params.abandonSignal]) : params.lifetime.controller.signal;
-	const waitForStartup = (operation, timeoutErrorFactory) => {
+	const waitForStartup = (operation, timeoutErrorFactory, candidateLimitMs) => {
 		if (abandonSignal.aborted) throw new CodexAppServerStartupError("aborted", "codex app-server initialize aborted");
-		return withCodexAppServerAcquireDeadline(resolveRemainingAcquireTimeout(timeoutMs, acquireStartedAt), ownCodexStartup(params.lifetime, operation()), abandonSignal, CODEX_APP_SERVER_INITIALIZE_TIMEOUT_MESSAGE, timeoutErrorFactory);
+		const remainingMs = resolveRemainingAcquireTimeout(timeoutMs, acquireStartedAt);
+		return withCodexAppServerAcquireDeadline(candidateLimitMs === void 0 ? remainingMs : remainingMs > 0 ? Math.min(remainingMs / 2, candidateLimitMs) : candidateLimitMs, ownCodexStartup(params.lifetime, operation()), abandonSignal, CODEX_APP_SERVER_INITIALIZE_TIMEOUT_MESSAGE, timeoutErrorFactory);
 	};
 	const startOptionsCandidates = resolveManagedFallbackStartOptions(params.startOptions);
+	const yieldInstalledCodex = (index, command, error) => {
+		if (params.startOptions.commandSource !== "resolved-managed" || index + 1 >= startOptionsCandidates.length || readInstalledCodexAppServerStatus(command) === void 0 || abandonSignal.aborted) return false;
+		try {
+			params.assertCurrent?.();
+		} catch {
+			return false;
+		}
+		const ownsFallback = params.onManagedFallback?.(startOptionsCandidates[index + 1]) ?? true;
+		rejectInstalledCodexAppServer(command, error);
+		if (!ownsFallback) throw new SharedCodexFallbackJoinError();
+		return true;
+	};
 	for (const [index, startOptions] of startOptionsCandidates.entries()) {
 		params.assertCurrent?.();
-		observeAcquire(params, { boundary: "prestart-artifact-drain" });
 		const desktopCommand = isManagedCodexDesktopCommand(startOptions.command);
 		const desktopGeneration = params.desktopGeneration ?? (desktopCommand ? await waitForStartup(waitForCodexDesktopGeneration) : void 0);
 		const assertStartupCurrent = () => {
 			params.assertCurrent?.();
 			if (abandonSignal.aborted) throw new CodexAppServerStartupError("aborted", "codex app-server initialize aborted");
-			if (desktopGeneration && !isCodexDesktopGenerationCurrent(desktopGeneration)) throw new CodexAppServerStartSelectionChangedError();
 		};
-		const computerUseConfig = resolveCodexComputerUseConfig({ pluginConfig: params.pluginConfig });
 		const ownsIsolatedCodexHome = params.requestedStartOptions.homeScope !== "user" && !params.requestedStartOptions.env?.CODEX_HOME?.trim();
-		const artifactDrain = desktopGeneration && ownsIsolatedCodexHome && computerUseConfig.enabled && (computerUseConfig.autoInstall || computerUseConfig.pluginCacheMode === "shared") ? createOlderDesktopGenerationDrainWait({
-			generation: desktopGeneration,
-			startOptions,
-			agentDir: params.agentDir
-		}) : void 0;
 		try {
-			if (artifactDrain) await waitForStartup(() => artifactDrain.promise);
 			await reconcileCodexComputerUseStartArtifacts({
 				startOptions,
 				agentDir: params.agentDir,
@@ -3298,10 +3191,8 @@ async function startInitializedCodexAppServerClientOnce(params) {
 				});
 			}
 			throw error;
-		} finally {
-			artifactDrain?.cancel();
 		}
-		const runtimeArtifactModule = params.runtimeArtifactMode ? await import("./runtime-artifact-C13pR7tD.mjs") : void 0;
+		const runtimeArtifactModule = params.runtimeArtifactMode ? await import("./runtime-artifact-CmLWeyJB.mjs") : void 0;
 		const runtimeArtifactBeforeStart = runtimeArtifactModule ? await runtimeArtifactModule.captureCodexAppServerRuntimeArtifactBeforeStart({
 			startOptions,
 			spawnIdentity: resolveCodexAppServerSpawnIdentity(startOptions),
@@ -3317,7 +3208,8 @@ async function startInitializedCodexAppServerClientOnce(params) {
 		try {
 			observeAcquire(params, { boundary: "transport-registration" });
 			client = await waitForStartup(() => {
-				starting = CodexAppServerClient.start(startOptions, () => {
+				starting = CodexAppServerClient.start(startOptions, async () => {
+					await params.assertCurrentAsync?.();
 					assertStartupCurrent();
 					resolveRemainingAcquireTimeout(timeoutMs, acquireStartedAt);
 				});
@@ -3329,6 +3221,7 @@ async function startInitializedCodexAppServerClientOnce(params) {
 				observeAcquire(params, { boundary: "cleanup" });
 				await ownCodexStartup(params.lifetime, starting.then((lateClient) => lateClient.closeAndWait(), () => {}));
 			}
+			if (yieldInstalledCodex(index, startOptions.command, error)) continue;
 			throw error;
 		}
 		client.addCloseHandler((closedClient) => {
@@ -3348,9 +3241,10 @@ async function startInitializedCodexAppServerClientOnce(params) {
 			params.onStartedClient?.(client);
 			observeAcquire(params, { boundary: "initialize" });
 			try {
-				await waitForStartup(() => client.initialize(), () => buildCodexAppServerInitializeTimeoutError(client));
+				await waitForStartup(() => client.initialize(), () => buildCodexAppServerInitializeTimeoutError(client), startOptions.commandSource === "resolved-managed" && index + 1 < startOptionsCandidates.length && readInstalledCodexAppServerStatus(startOptions.command) !== void 0 ? INSTALLED_CODEX_START_TIMEOUT_MS : void 0);
+				if (startOptions.commandSource === "resolved-managed") assertInstalledCodexAppServerVersion(startOptions.command, client.getServerVersion());
 			} catch (error) {
-				if (startOptions.commandSource === "resolved-managed" && index < startOptionsCandidates.length - 1 && isUnsupportedCodexAppServerVersionError(error)) continue;
+				if (yieldInstalledCodex(index, startOptions.command, error) || startOptions.commandSource === "resolved-managed" && index < startOptionsCandidates.length - 1 && isUnsupportedCodexAppServerVersionError(error)) continue;
 				throw error;
 			}
 			assertStartupCurrent();
@@ -3379,7 +3273,7 @@ async function startInitializedCodexAppServerClientOnce(params) {
 				...params.authProfileStore ? { authProfileStore: params.authProfileStore } : {},
 				config: params.config,
 				onAuthRefreshFailure: () => retireSharedCodexAppServerClientIfCurrent(client)
-			});
+			}, () => refreshSharedClientIdleRetirement(client));
 			assertStartupCurrent();
 			observeAcquire(params, { boundary: "auth-handoff" });
 			const authHandoff = await waitForStartup(() => applyCodexAppServerAuthProfile({
@@ -3391,34 +3285,24 @@ async function startInitializedCodexAppServerClientOnce(params) {
 				startOptions,
 				config: params.config,
 				assertCurrent: assertStartupCurrent,
+				assertCurrentAsync: params.assertCurrentAsync,
 				...params.authProfileStore ? { authProfileStore: params.authProfileStore } : {}
 			}));
 			const ownsInference = startOptions.transport === "stdio" && nativeCommandAtStart && !isCodexAppServerProxyLaunch(startOptions.args);
 			if (isCodexResponsesOAuth(params.preparedAuth) && (!ownsInference || desktopGeneration || desktopCommand)) throw new Error("ChatGPT subscription sharing requires a managed local Codex process.");
 			if (ownsInference) {
 				const prepared = params.preparedAuth;
-				ownCodexInferenceClient(client, startOptions, isCodexResponsesOAuth(prepared) && prepared?.kind === "profile" ? createCodexResponsesOAuth({
+				ownCodexInferenceClient(client, startOptions, isCodexResponsesOAuth(prepared) && prepared?.kind === "profile" ? await waitForStartup(() => createCodexResponsesOAuth({
 					profileId: prepared.profileId,
 					store: prepared.store,
 					fingerprint: prepared.snapshot.secretFreeCacheKey,
 					agentDir: params.agentDir,
 					config: params.config
-				}) : void 0);
+				})) : void 0);
 			}
 			recordCodexAppServerAuthHandoff(client, authHandoff);
 			if (runtimeArtifactModule && runtimeArtifact) runtimeArtifactModule.bindCodexAppServerRuntimeArtifact(client, runtimeArtifact);
 			assertStartupCurrent();
-			const fenceKey = resolveCodexNativeConfigFenceKey({ client });
-			if (fenceKey) client.setThreadSessionRequestGuard(async (options) => {
-				const release = await acquireCodexNativeConfigFence(fenceKey, options);
-				try {
-					assertCodexAppServerClientStartSelectionCurrent({ client });
-					return release;
-				} catch (error) {
-					release();
-					throw error;
-				}
-			}, () => Boolean(retireSharedCodexAppServerClientIfCurrent(client)));
 			ready = true;
 			observeAcquire(params, { boundary: "ready" });
 			return client;
@@ -3431,34 +3315,11 @@ async function startInitializedCodexAppServerClientOnce(params) {
 	}
 	throw new Error("Managed Codex app-server fallback candidates were exhausted.");
 }
-function isCodexComputerUseCandidateArtifactsUnavailableError(error) {
-	return error !== null && typeof error === "object" && "code" in error && error.code === "CODEX_COMPUTER_USE_CANDIDATE_ARTIFACTS_UNAVAILABLE";
-}
-function resolveManagedFallbackStartOptions(startOptions) {
-	const commands = [startOptions.command, ...startOptions.managedFallbackCommandPaths ?? []];
-	const candidates = [];
-	for (const [index, command] of commands.entries()) {
-		const managedFallbackCommandPaths = commands.slice(index + 1);
-		const candidate = {
-			...startOptions,
-			command
-		};
-		if (managedFallbackCommandPaths.length === 0) delete candidate.managedFallbackCommandPaths;
-		else candidate.managedFallbackCommandPaths = managedFallbackCommandPaths;
-		candidates.push(candidate);
-	}
-	return candidates;
-}
 function detachCurrentSharedClient(client) {
 	const entry = client && getCurrentSharedClientEntry(client);
 	return Boolean(entry && getSharedCodexAppServerClientState().clients.delete(entry.key));
 }
-function clearSharedCodexAppServerClientIfCurrent(client) {
-	if (!detachCurrentSharedClient(client)) return false;
-	client.close();
-	return true;
-}
-/** Captures a revocable observation of the exact shared client and native account/config. */
+/** Captures the physical client lifetime for passive catalog reads. */
 function captureSharedCodexAppServerCatalogLifetime(client) {
 	const isCurrent = captureSharedClientRegistration(client);
 	const revision = client.getModelCatalogRevision();
@@ -3468,8 +3329,7 @@ function captureSharedCodexAppServerCatalogLifetime(client) {
 function captureSharedClientRegistration(client) {
 	const state = getSharedCodexAppServerClientState();
 	const entry = getCurrentSharedClientEntry(client);
-	const generation = readCodexAppServerClientDesktopGeneration(client);
-	return () => entry !== void 0 && state.clients.get(entry.key) === entry && entry.client === client && !entry.closeWhenIdle && !entry.closeError && !client.getCloseError() && (!generation || isCodexDesktopGenerationCurrent(generation));
+	return () => entry !== void 0 && state.clients.get(entry.key) === entry && entry.client === client && !entry.closeWhenIdle && !entry.closeError && !client.getCloseError();
 }
 function retainSharedCodexAppServerClientIfCurrent(client) {
 	const entry = getCurrentSharedClientEntry(client);
@@ -3483,47 +3343,10 @@ function captureCodexAppServerClientLifetime(client, requiredOwnership) {
 	const isCurrent = requiredOwnership !== "connection" && state.isolatedClients.has(client) ? () => state.isolatedClients.has(client) && !client.getCloseError() : captureSharedClientRegistration(client);
 	const assertCurrent = () => {
 		if (!isCurrent()) throw new CodexAdoptedThreadActiveError("Codex app-server connection changed during thread preparation; reconnect before continuing");
-		assertCodexAppServerClientStartSelectionCurrent({ client });
 	};
 	assertCurrent();
 	return assertCurrent;
 }
-function createOlderDesktopGenerationDrainWait(params) {
-	const targetHome = resolveCodexNativeConfigFenceKey({
-		startOptions: params.startOptions,
-		agentDir: params.agentDir
-	});
-	if (!targetHome) return {
-		promise: Promise.resolve(),
-		cancel: () => void 0
-	};
-	const state = getSharedCodexAppServerClientState();
-	const { promise, resolve: resolveWait } = createDeferred();
-	const cancel = () => {
-		state.desktopGenerationDrainChecks.delete(check);
-		resolveWait();
-	};
-	const check = () => {
-		if (!hasLiveOlderDesktopGenerationClient({
-			state,
-			generation: params.generation,
-			targetHome
-		})) cancel();
-	};
-	state.desktopGenerationDrainChecks.add(check);
-	check();
-	return {
-		promise,
-		cancel
-	};
-}
-function hasLiveOlderDesktopGenerationClient(params) {
-	for (const clients of [params.state.liveClients, params.state.isolatedClients]) for (const client of clients) {
-		const metadata = params.state.startMetadata.get(client);
-		if (metadata?.desktopGeneration && metadata.desktopGeneration.epoch < params.generation.epoch && resolveCodexNativeConfigFenceKey({ client }) === params.targetHome) return true;
-	}
-	return false;
-}
 async function clearSharedCodexAppServerClientIfCurrentAndWait(client, options) {
 	if (!detachCurrentSharedClient(client)) return false;
 	await client.closeAndWait(options);
@@ -3555,4 +3378,4 @@ function clearSharedCodexAppServerClientIfCurrentAndUnclaimed(client) {
 	};
 }
 //#endregion
-export { createCodexEphemeralThreadPolicy as $, bindCodexInferenceThread as A, isCodexAppServerClientRuntimeLive as B, CodexThreadBindingConflictError as C, nativeHookRelayUnregisterQueue as D, isCodexContextRestartSelectionChangedError as E, consumeCodexAppServerLiveThread as F, readCodexClientSessionMeta as G, isCodexAppServerLiveThreadProtected as H, ensureCodexAppServerClientRuntime as I, revertCodexAppServerLiveThreadInstructions as J, releaseCodexAppServerLiveThread as K, forgetCodexWorkspaceReferences as L, getCodexInferenceThreadQualification as M, prepareCodexInferenceThreadConfig as N, acquireCodexNativeConfigFence as O, claimCodexAppServerLiveThread as P, rememberCodexRateLimitsRead as Q, hasCodexAppServerLiveThread as R, CodexAdoptedThreadActiveError as S, CodexThreadStartRequestError as T, prepareCodexWorkspaceReferences as U, isCodexAppServerLiveThreadClaimed as V, protectCodexAppServerLiveThread as W, readCodexRateLimitsRevision as X, unsubscribeCodexAppServerLiveThread as Y, readRecentCodexRateLimits as Z, retainSharedCodexAppServerClientIfCurrent as _, clearSharedCodexAppServerClientIfCurrentAndUnclaimed as a, hasLegacyCodexComputerUseMcpPolicy as at, withLeasedCodexAppServerClientStartSelectionRetry as b, getLeasedSharedCodexAppServerClient as c, ensureCodexComputerUseSharedPluginCache as ct, readCodexAppServerClientDesktopGeneration as d, TURN_FINALIZE_DRAIN_ABORT_GRACE_MS as dt, reconcileCodexComputerUseStartArtifacts as et, readCodexAppServerClientDesktopGenerationFingerprint as f, TURN_TERMINAL_SETTLEMENT_TIMEOUT_MS as ft, resolveCodexNativeConfigFenceKey as g, withCodexStartupTimeout as gt, releaseLeasedSharedCodexAppServerClient as h, resolveCodexStartupTimeoutMs as ht, clearSharedCodexAppServerClientIfCurrent as i, resolveClientManagedBundledMarketplacePath as it, getCodexInferenceThread as j, assertCodexInferenceRouteConfig as k, getSharedCodexAppServerClient as l, assertNotSymlink as lt, releaseCodexAppServerClientLease as m, resolveCodexGatewayTimeoutWithGraceMs as mt, captureCodexAppServerClientLifetime as n, resolveCodexAppServerPreparedAuthHandoff as nt, clearSharedCodexAppServerClientIfCurrentAndWait as o, isLegacyCodexComputerUsePluginDisabled as ot, readCodexAppServerClientProcessIdentity as p, isCodexAppServerStartupError as pt, retainCodexAppServerLiveThread as q, captureSharedCodexAppServerCatalogLifetime as r, resolveBundledComputerUseMarketplacePath as rt, createIsolatedCodexAppServerClient as s, resolveManagedCodexComputerUseConfig as st, assertCodexAppServerClientStartSelectionCurrent as t, resolveCodexAppServerAuthAccountCacheKey as tt, isCodexAppServerStartSelectionChangedError as u, CodexAppServerStartupError as ut, shared_client_exports as v, CodexThreadClientReplacementError as w, CODEX_APP_SERVER_CONTEXT_RESTART_SELECTION_CHANGED as x, waitForCodexAppServerClientDesktopGenerationDrain as y, hasCodexAppServerSiblingThreadWork as z };
+export { resolveBundledComputerUseMarketplacePath as $, hasCodexAppServerLiveThread as A, retainCodexAppServerLiveThread as B, getCodexInferenceThread as C, consumeCodexAppServerLiveThread as D, claimCodexAppServerLiveThread as E, prepareCodexWorkspaceReferences as F, rememberCodexRateLimitsRead as G, unsubscribeCodexAppServerLiveThread as H, protectCodexAppServerLiveThread as I, recordCodexTurnForkSettings as J, createCodexEphemeralThreadPolicy as K, readCodexClientSessionMeta as L, isCodexAppServerClientRuntimeLive as M, isCodexAppServerLiveThreadClaimed as N, ensureCodexAppServerClientRuntime as O, isCodexAppServerLiveThreadProtected as P, resolveCodexAppServerPreparedAuthHandoff as Q, readCodexLiveThreadEphemeralPolicy as R, bindCodexInferenceThread as S, prepareCodexInferenceThreadConfig as T, readCodexRateLimitsRevision as U, revertCodexAppServerLiveThreadInstructions as V, readRecentCodexRateLimits as W, reconcileCodexComputerUseStartArtifacts as X, requireCodexThreadForkSettings as Y, resolveCodexAppServerAuthAccountCacheKey as Z, CodexThreadBindingConflictError as _, createIsolatedCodexAppServerClient as a, assertNotSymlink as at, nativeHookRelayUnregisterQueue as b, readCodexAppServerClientDesktopGeneration as c, TURN_TERMINAL_SETTLEMENT_TIMEOUT_MS as ct, releaseCodexAppServerClientLease as d, resolveCodexStartupTimeoutMs as dt, resolveClientManagedBundledMarketplacePath as et, releaseLeasedSharedCodexAppServerClient as f, withCodexStartupTimeout as ft, CodexAdoptedThreadActiveError as g, withCodexAppServerClientRequestScope as h, clearSharedCodexAppServerClientIfCurrentAndWait as i, ensureCodexComputerUseSharedPluginCache as it, hasCodexAppServerSiblingThreadWork as j, forgetCodexWorkspaceReferences as k, readCodexAppServerClientDesktopGenerationFingerprint as l, isCodexAppServerStartupError as lt, shared_client_exports as m, captureSharedCodexAppServerCatalogLifetime as n, isLegacyCodexComputerUsePluginDisabled as nt, getLeasedSharedCodexAppServerClient as o, CodexAppServerStartupError as ot, retainSharedCodexAppServerClientIfCurrent as p, recordCodexThreadForkSettings as q, clearSharedCodexAppServerClientIfCurrentAndUnclaimed as r, resolveManagedCodexComputerUseConfig as rt, getSharedCodexAppServerClient as s, TURN_FINALIZE_DRAIN_ABORT_GRACE_MS as st, captureCodexAppServerClientLifetime as t, hasLegacyCodexComputerUseMcpPolicy as tt, readCodexAppServerClientProcessIdentity as u, resolveCodexGatewayTimeoutWithGraceMs as ut, CodexThreadClientReplacementError as v, getCodexInferenceThreadQualification as w, assertCodexInferenceRouteConfig as x, CodexThreadStartRequestError as y, releaseCodexAppServerLiveThread as z };