@openclaw/codex 2026.10.5-beta.4 → 2026.10.10-beta.1

package/dist/.setup/{upstream-session-fork-p5fwKi7w.mjs → upstream-session-fork-_LYkh0nZ.mjs}

@@ -1,171 +1,49 @@
-import { i as isJsonObject, r as flattenCodexDynamicToolFunctions } from "./protocol-CANUwXJ3.mjs";
-import { m as sessionBindingIdentity } from "./session-binding-record-DU_0biMD.mjs";
+import { n as flattenCodexDynamicToolFunctions, r as isJsonObject } from "./protocol-CaPAVwe9.mjs";
+import { g as sessionBindingIdentity } from "./session-binding-record-C_THntMe.mjs";
 import { d as readCodexPluginConfig } from "./config-parsing-DsWSCPHO.mjs";
-import { s as assertCodexModelBackedReviewerEffectiveConfig } from "./config-options-DDzeNQ8m.mjs";
+import { s as assertCodexModelBackedReviewerEffectiveConfig } from "./config-options-DMFZkd3X.mjs";
 import { t as withCodexAppServerThreadMutation } from "./thread-ownership-queue-CeyYScUC.mjs";
-import { i as CodexAppServerScopedRequestRejectedError, o as isCodexAppServerOverloadError } from "./rpc-error-C98SHchT.mjs";
+import { i as CodexAppServerScopedRequestRejectedError, o as isCodexAppServerOverloadError } from "./rpc-error-DemqqaxE.mjs";
 import { a as readUpstreamUserText, i as readMirrorIdentity } from "./upstream-prompt-provenance-Ccd9MFRJ.mjs";
-import { r as projectCodexUserItemText } from "./transcript-history-projection-DfKcoZCB.mjs";
+import { r as projectCodexUserItemText } from "./transcript-history-projection-i-FVpyha.mjs";
 import { n as codexUpstreamBaseline, t as codexLastTerminalTurnId } from "./session-upstream-marker-D15C9NHp.mjs";
-import { r as buildCodexPluginAppCacheKey } from "./plugin-app-cache-key-Bg9DbDI6.mjs";
-import { n as readCodexSessionMeta } from "./session-catalog-provenance-CmsOE5mh.mjs";
-import "./request-Bo0kKABI.mjs";
-import { r as resolveOpenClawExecPolicyForCodexAppServer } from "./config-C1YVVLEA.mjs";
-import { r as resolveCodexSupervisionAppServerRuntimeOptions } from "./config-runtime-DWzK-k0n.mjs";
+import { r as buildCodexPluginAppCacheKey } from "./plugin-app-cache-key-DRb-niJc.mjs";
+import { n as readCodexSessionMeta } from "./session-catalog-provenance-Dg9s12z-.mjs";
+import "./request-ePeNJrOd.mjs";
+import { r as resolveOpenClawExecPolicyForCodexAppServer } from "./config-BfrAlTMT.mjs";
+import { r as resolveCodexSupervisionAppServerRuntimeOptions } from "./config-runtime-BZRizyuG.mjs";
 import { l as readCodexMirrorSourceFingerprint, o as fingerprintCodexMirrorSourceMessage } from "./transcript-mirror-attestation-BzUXnrvv.mjs";
-import { P as claimCodexAppServerLiveThread, R as hasCodexAppServerLiveThread, f as readCodexAppServerClientDesktopGenerationFingerprint } from "./shared-client-BCx1wbyA.mjs";
-import { m as assertCodexThreadForkResponse, p as assertCodexThreadAcceptsDirectInput, s as isCodexAppServerPrewriteRequestCancellationError } from "./client-D93nbdB8.mjs";
-import { d as mergeCodexThreadConfigs, i as buildCodexPluginThreadConfig, p as shouldBuildCodexPluginThreadConfig } from "./project-doc-thread-config-BVcvnps8.mjs";
-import { T as fingerprintUserMcpServersConfigPatch, _ as buildDeveloperInstructions, a as buildCodexThreadConfiguration, b as codexDynamicToolsFingerprint, h as resolveCodexWebSearchPlan, w as fingerprintJsonObject } from "./thread-requests-BgzJwJtS.mjs";
-import "./session-binding-JEHNMPsr.mjs";
-import "./thread-ownership-BoUd0i6L.mjs";
-import { n as resolveCodexNativeExecutionPolicy } from "./native-execution-policy-MXEe7PB3.mjs";
-import { n as CodexThreadPolicyHandoffError, o as refreshCodexThreadPolicy } from "./thread-policy-B3wBRNph.mjs";
-import { b as isCodexDynamicToolExcluded, f as codexNativeHookRemoteCredentialPath, i as buildCodexNativeHookRelayConfig, l as resolveCodexNativeHookRelayEvents, o as buildCodexNativeHookRelayId, r as assertCodexNativeHookRelayAllowed } from "./native-hook-relay-wq7jrNLk.mjs";
-import { c as parseCodexNativeToolCatalog, i as checkCodexThreadAppAvailability, n as resolveCodexNativeSkillIsolation, t as applyCodexNativeSkillIsolation } from "./native-skill-isolation-DSBeF-Yy.mjs";
-import { c as prepareCodexWorkspaceDeveloperInstructions } from "./attempt-workspace-context-CcwP3DA3.mjs";
-import { n as resolveCodexProviderWebSearchSupportForClient } from "./provider-capabilities-Dn2WwH4P.mjs";
-import { n as prepareCodexSessionInitialization } from "./session-initialization-Bi_2DKhc.mjs";
-import { createImportedCodexSession } from "./session-history-import-CaO8s6ta.mjs";
+import { A as hasCodexAppServerLiveThread, E as claimCodexAppServerLiveThread, l as readCodexAppServerClientDesktopGenerationFingerprint } from "./shared-client-CE_uY0A1.mjs";
+import { f as assertCodexThreadAcceptsDirectInput, o as isCodexAppServerPrewriteRequestCancellationError, p as assertCodexThreadForkResponse } from "./client-BS8X7HmG.mjs";
+import { d as mergeCodexThreadConfigs, i as buildCodexPluginThreadConfig, p as shouldBuildCodexPluginThreadConfig } from "./project-doc-thread-config-B0UI3f1D.mjs";
+import { T as fingerprintUserMcpServersConfigPatch, _ as buildDeveloperInstructions, a as buildCodexThreadConfiguration, b as codexDynamicToolsFingerprint, h as resolveCodexWebSearchPlan, w as fingerprintJsonObject } from "./thread-requests-BjawdIVV.mjs";
+import "./session-binding-BgsWcbdY.mjs";
+import "./thread-ownership-t6Y9fLQS.mjs";
+import { i as resolveCodexNativeExecutionPolicy } from "./native-execution-policy-D09tLP-u.mjs";
+import { n as CodexThreadPolicyHandoffError, o as refreshCodexThreadPolicy } from "./thread-policy-Cy301Or8.mjs";
+import { b as isCodexDynamicToolExcluded, f as codexNativeHookRemoteCredentialPath, i as buildCodexNativeHookRelayConfig, l as resolveCodexNativeHookRelayEvents, o as buildCodexNativeHookRelayId, r as assertCodexNativeHookRelayAllowed } from "./native-hook-relay-C7aaLJaP.mjs";
+import { c as parseCodexNativeToolCatalog, i as checkCodexThreadAppAvailability, n as resolveCodexNativeSkillIsolation, t as applyCodexNativeSkillIsolation } from "./native-skill-isolation-CMimsKYy.mjs";
+import { c as prepareCodexWorkspaceDeveloperInstructions } from "./attempt-workspace-context-GYPLawX6.mjs";
+import { n as resolveCodexProviderWebSearchSupportForClient } from "./provider-capabilities-DjcKunHS.mjs";
+import { n as prepareCodexSessionInitialization } from "./session-initialization-Dn3vveGv.mjs";
+import { createImportedCodexSession } from "./session-history-import-BwPKwcNi.mjs";
 import { isRecord, normalizeOptionalString, readNonBlankString } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { randomUUID } from "node:crypto";
 import { isDeepStrictEqual } from "node:util";
-import path from "node:path";
-import { lstat } from "node:fs/promises";
-import { root } from "openclaw/plugin-sdk/file-access-runtime";
-import { constants, createZstdDecompress } from "node:zlib";
 import { resolveAgentWorkspaceDir } from "openclaw/plugin-sdk/agent-runtime";
 import { loadCodexBundleMcpThreadConfig } from "openclaw/plugin-sdk/agent-harness-runtime";
-import { loadExecApprovals } from "openclaw/plugin-sdk/exec-approvals-runtime";
+import { loadExecApprovalsReadOnlyAsync } from "openclaw/plugin-sdk/exec-approvals-runtime";
 import { resolveStorePath } from "openclaw/plugin-sdk/session-store-runtime";
 import { appendSessionTranscriptMessagesByIdentity, readVisibleSessionTranscriptMessageEntries } from "openclaw/plugin-sdk/session-transcript-runtime";
 import { buildCodexUserMcpServersThreadConfigPatchForRuntime, resolveCodexMcpToolOverridesForAgent } from "openclaw/plugin-sdk/codex-mcp-projection";
 import { buildNativeHookRelayCommandPlan } from "openclaw/plugin-sdk/native-hook-relay-runtime";
-//#region extensions/codex/src/session-rollout-snapshot.ts
-const CHUNK_BYTES = 65536;
-const META_BYTES = 1048576;
-const COMPRESSED_BYTES = 8388608;
-const DEADLINE_MS = 5e3;
-const utf8Decoder = new TextDecoder("utf-8", { fatal: true });
-function parseMetadata(line, threadId) {
-	const parsed = JSON.parse(utf8Decoder.decode(line));
-	if (!isRecord(parsed) || parsed.type !== "session_meta" || !isRecord(parsed.payload) || parsed.payload.id !== threadId) throw new Error("Codex rollout does not belong to the bound thread");
-	return parsed.payload;
-}
-/** Read immutable metadata while pinning the entire rollout against concurrent writers. */
-async function readCodexRolloutSnapshot(params) {
-	const deadline = Date.now() + DEADLINE_MS;
-	const check = () => {
-		params.assertCurrent();
-		if (Date.now() >= deadline) throw new Error("Codex rollout metadata observation timed out");
-	};
-	check();
-	const rootStat = await lstat(params.sessionsRoot);
-	if (!rootStat.isDirectory() || rootStat.isSymbolicLink()) throw new Error("Codex rollout root is not a verified local directory");
-	const safeRoot = await root(params.sessionsRoot, {
-		hardlinks: "reject",
-		symlinks: "reject",
-		maxBytes: Number.MAX_SAFE_INTEGER
-	});
-	const plain = params.rolloutPath.endsWith(".zst") ? params.rolloutPath.slice(0, -4) : params.rolloutPath;
-	let selected = plain;
-	let opened;
-	try {
-		opened = await safeRoot.open(path.relative(params.sessionsRoot, selected));
-	} catch (error) {
-		if (!isRecord(error) || error.code !== "not-found" && error.code !== "ENOENT") throw error;
-		selected = `${plain}.zst`;
-		opened = await safeRoot.open(path.relative(params.sessionsRoot, selected));
-	}
-	try {
-		check();
-		const snapshot = opened.stat;
-		const unchanged = (stat) => stat.dev === snapshot.dev && stat.ino === snapshot.ino && stat.size === snapshot.size && stat.mtimeMs === snapshot.mtimeMs && stat.ctimeMs === snapshot.ctimeMs && stat.nlink === 1;
-		if (!snapshot.size) throw new Error("Codex rollout metadata is incomplete");
-		const compressed = selected.endsWith(".zst");
-		if (compressed && snapshot.size > COMPRESSED_BYTES) throw new Error("Compressed Codex rollout exceeds the observation limit");
-		const input = opened.handle.createReadStream({
-			autoClose: false,
-			highWaterMark: CHUNK_BYTES,
-			end: snapshot.size - 1
-		});
-		const decoder = compressed ? createZstdDecompress({
-			chunkSize: CHUNK_BYTES,
-			params: { [constants.ZSTD_d_windowLogMax]: 25 }
-		}) : void 0;
-		if (decoder) {
-			input.on("error", (error) => decoder.destroy(error));
-			input.pipe(decoder);
-		}
-		const reader = decoder ?? input;
-		const timer = setTimeout(() => reader.destroy(/* @__PURE__ */ new Error("Codex rollout metadata observation timed out")), Math.max(1, deadline - Date.now()));
-		let metadata;
-		const chunks = [];
-		let total = 0;
-		try {
-			for await (const chunk of reader) {
-				check();
-				const bytes = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
-				const newline = bytes.indexOf(10);
-				const prefix = newline < 0 ? bytes : bytes.subarray(0, newline);
-				total += prefix.length;
-				if (total > META_BYTES) throw new Error("Codex rollout metadata exceeds the observation limit");
-				chunks.push(prefix);
-				if (newline >= 0) {
-					metadata = parseMetadata(Buffer.concat(chunks), params.threadId);
-					if (!unchanged(await opened.handle.stat())) throw new Error("Codex rollout changed during metadata observation");
-					break;
-				}
-			}
-		} finally {
-			clearTimeout(timer);
-			reader.destroy();
-			input.destroy();
-		}
-		if (!metadata) throw new Error("Codex rollout metadata is incomplete");
-		const assertUnchanged = async () => {
-			params.assertCurrent();
-			if (selected !== plain) {
-				try {
-					await lstat(plain);
-				} catch (error) {
-					if (!isRecord(error) || error.code !== "ENOENT") throw error;
-					return await verifySelected();
-				}
-				throw new Error("Codex rollout selection changed during metadata observation");
-			}
-			await verifySelected();
-		};
-		const verifySelected = async () => {
-			params.assertCurrent();
-			const currentRoot = await lstat(params.sessionsRoot);
-			const fresh = await safeRoot.open(path.relative(params.sessionsRoot, selected));
-			try {
-				const stat = fresh.stat;
-				if (!unchanged(stat) || currentRoot.isSymbolicLink() || currentRoot.ino !== rootStat.ino || currentRoot.dev !== rootStat.dev) throw new Error("Codex rollout changed during metadata observation");
-			} finally {
-				await fresh.handle.close();
-			}
-			params.assertCurrent();
-		};
-		await assertUnchanged();
-		check();
-		return {
-			metadata,
-			assertUnchanged
-		};
-	} finally {
-		await opened.handle.close();
-	}
-}
-//#endregion
 //#region extensions/codex/src/app-server/canonical-fork-preparation.ts
 /** Creation preserves native declarations; admitted turns own all live executors. */
 async function prepareCanonicalCodexFork(params) {
 	const { created, initialization, config, context } = params;
 	const assertCurrent = initialization.assertCurrent;
 	assertCurrent();
-	if (!initialization.prepareNativeToolPolicy) throw new Error("Canonical Codex forks require host native tool policy preparation. Update the Gateway before retrying.");
+	if (!initialization.prepareNativeToolPolicy) throw new Error("Forking an OpenClaw Codex session requires host native tool policy preparation. Update the Gateway before retrying.");
 	const workspaceDir = resolveAgentWorkspaceDir(config, created.agentId);
 	const cwd = created.entry.spawnedCwd ?? workspaceDir;
 	const execution = resolveCodexNativeExecutionPolicy({
@@ -186,7 +64,7 @@ async function prepareCanonicalCodexFork(params) {
 			execPolicy: resolveOpenClawExecPolicyForCodexAppServer({
 				config,
 				agentId: created.agentId,
-				approvals: loadExecApprovals()
+				approvals: await loadExecApprovalsReadOnlyAsync()
 			})
 		}),
 		start: context.appServer.start
@@ -468,60 +346,37 @@ async function resolveCodexUpstreamForkBoundary(params) {
 			turns,
 			localPrefix
 		});
-		const selected = canonical ? entries.slice(0, entries.indexOf(target) + 1) : [];
-		const displayPrefix = selected.slice(0, -1);
+		const displayPrefix = (canonical ? entries.slice(0, entries.indexOf(target) + 1) : []).slice(0, -1);
 		if (canonical && (displayPrefix.length > 200 || Buffer.byteLength(JSON.stringify(displayPrefix)) > 524288)) return failure("upstream-unavailable", "The local display prefix exceeds the safe fork-copy limit. Use native Codex to fork this conversation.");
-		const frozen = structuredClone(selected);
-		const prefix = frozen.slice(0, -1);
 		return resolved.ok ? {
 			...resolved,
 			editorText: textOnlyMessage("content" in target.message ? target.message.content : void 0),
 			...canonical ? { canonical: {
 				thread,
 				turns,
-				prefix,
-				assertUnchanged: async () => {
-					const current = await readVisibleSessionTranscriptMessageEntries(params);
-					const index = current.findIndex((entry) => entry.entryId === params.entryId);
-					if (index < 0 || !isDeepStrictEqual(current.slice(0, index + 1), frozen)) throw new Error("The local Codex fork prefix changed during initialization");
-					const currentThread = await params.control.readThread(threadId, false);
-					assertCodexThreadAcceptsDirectInput(currentThread);
-					if (currentThread.id !== thread.id || currentThread.path !== thread.path || currentThread.cwd !== thread.cwd || currentThread.historyMode !== thread.historyMode || currentThread.model !== thread.model || currentThread.modelProvider !== thread.modelProvider || currentThread.status?.type === "active") throw new Error("The canonical Codex source changed during initialization");
-					const currentTurns = await listCodexUpstreamTurns(params.control, threadId);
-					const cut = turns.findIndex((turn) => turn.id === resolved.boundary.beforeTurnId);
-					if (!isDeepStrictEqual(currentTurns.slice(0, cut + 1), turns.slice(0, cut + 1))) throw new Error("The canonical Codex fork boundary changed during initialization");
-				}
+				prefix: displayPrefix
 			} } : {}
 		} : resolved;
 	} catch {
 		return failure("upstream-unavailable", "The Codex thread could not be read. Check that Codex is available, then try again.");
 	}
 }
-function precheckCodexUpstreamForkBoundary(params) {
-	const target = params.turns.find((turn) => turn.id === params.boundary.beforeTurnId);
-	if (!target) return failure("upstream-unavailable", "The Codex thread changed before it could be forked. Refresh the session and try again.");
-	if (target.status === "inProgress") return failure("in-progress-turn", IN_PROGRESS_TURN_MESSAGE);
-	return {
-		ok: true,
-		boundary: params.boundary
-	};
-}
 //#endregion
 //#region extensions/codex/src/app-server/canonical-session-fork.ts
 /** Native history stays native; only the verified local display prefix is copied. */
 async function forkCanonicalCodexSession(params) {
 	const { fork, resolved, control, bindingStore, sourceBinding, config } = params;
 	const context = control.forkContext;
-	if (!context?.localSessionsRoot || !resolved.canonical.thread.path) throw new Error("Canonical Codex forks require the verified local rollout on its selected connection. Fork an original imported message instead.");
+	if (!context?.localSessionsRoot || !resolved.canonical.thread.path) throw new Error("Forking an OpenClaw Codex session requires the verified local rollout on its selected connection. Fork an original imported message instead.");
 	const model = normalizeOptionalString(resolved.canonical.thread.model);
 	const modelProvider = normalizeOptionalString(resolved.canonical.thread.modelProvider);
-	if (!model || !modelProvider) throw new Error("Codex did not report the canonical thread's model selection. Use Codex 0.153.0 or newer, or fork an original imported message instead.");
+	if (!model || !modelProvider) throw new Error("Codex did not report the source thread's model selection. Use Codex 0.153.0 or newer, or fork an original imported message instead.");
 	const sourceIdentity = sessionBindingIdentity({
 		...fork.source,
 		config
 	});
 	return bindingStore.withLease(sourceIdentity, async () => {
-		if (!isDeepStrictEqual(bindingStore.read(sourceIdentity), sourceBinding)) throw new Error("Codex canonical source binding changed before initialization");
+		if (!isDeepStrictEqual(bindingStore.read(sourceIdentity), sourceBinding)) throw new Error("Codex source binding changed before initialization");
 		let freshThreadId;
 		let ownership;
 		let subscriptionReleased = false;
@@ -538,7 +393,7 @@ async function forkCanonicalCodexSession(params) {
 					modelSelectionLocked: true
 				},
 				afterCreate: async (created) => {
-					if (!created.initialization) throw new Error("Canonical Codex forks require host creation authority");
+					if (!created.initialization) throw new Error("Forking an OpenClaw Codex session requires host creation authority");
 					const host = created.initialization;
 					const initialization = prepareCodexSessionInitialization({
 						initialization: host,
@@ -579,15 +434,11 @@ async function forkCanonicalCodexSession(params) {
 						initialization.assertCurrent();
 						if (ownership && !subscriptionReleased) ownership.assertCurrent();
 					};
-					const snapshot = await readCodexRolloutSnapshot({
-						sessionsRoot: context.localSessionsRoot,
-						rolloutPath: resolved.canonical.thread.path,
-						threadId: sourceBinding.threadId,
-						assertCurrent
-					});
+					const metadata = await readCodexSessionMeta(context.localSessionsRoot, resolved.canonical.thread.path.replace(/\.zst$/, ""), sourceBinding.threadId, { canonicalSource: true });
 					assertCurrent();
-					if (!sourceBinding.dynamicToolsFingerprint) throw new Error("The canonical source has no verified native catalog binding");
-					const sourceCatalog = parseCodexNativeToolCatalog(snapshot.metadata, sourceBinding.threadId, sourceBinding.dynamicToolsFingerprint);
+					if (!metadata) throw new Error("The source Codex rollout metadata could not be verified");
+					if (!sourceBinding.dynamicToolsFingerprint) throw new Error("The source session has no verified native catalog binding");
+					const sourceCatalog = parseCodexNativeToolCatalog(metadata, sourceBinding.threadId, sourceBinding.dynamicToolsFingerprint);
 					const prepared = await prepareCanonicalCodexFork({
 						created,
 						initialization: host,
@@ -599,11 +450,7 @@ async function forkCanonicalCodexSession(params) {
 						dynamicTools: sourceCatalog
 					});
 					assertCurrent();
-					await snapshot.assertUnchanged();
-					assertCurrent();
-					await resolved.canonical.assertUnchanged();
-					assertCurrent();
-					if (!isDeepStrictEqual(bindingStore.read(sourceIdentity), sourceBinding)) throw new Error("Codex canonical source binding changed during preparation");
+					if (!isDeepStrictEqual(bindingStore.read(sourceIdentity), sourceBinding)) throw new Error("Codex source binding changed during preparation");
 					assertCurrent();
 					let raw;
 					try {
@@ -623,14 +470,11 @@ async function forkCanonicalCodexSession(params) {
 					let response;
 					try {
 						response = assertCodexThreadForkResponse(raw);
+						if (!response.thread.id.trim() || response.thread.id === sourceBinding.threadId || response.thread.id === fork.upstream.threadId || response.thread.forkedFromId !== sourceBinding.threadId || await bindingStore.hasOtherThreadOwner(response.thread.id)) throw new Error("Codex fork returned an unsafe native thread identity");
 					} catch (error) {
 						control.retireConnection?.();
 						throw error;
 					}
-					if (!response.thread.id.trim() || response.thread.id === sourceBinding.threadId || response.thread.id === fork.upstream.threadId || response.thread.forkedFromId !== sourceBinding.threadId || await bindingStore.hasOtherThreadOwner(response.thread.id)) {
-						control.retireConnection?.();
-						throw new Error("Codex fork returned an unsafe native thread identity");
-					}
 					freshThreadId = response.thread.id;
 					ownership = await claimCodexAppServerLiveThread(context.client, freshThreadId);
 					if (!ownership) {
@@ -638,26 +482,22 @@ async function forkCanonicalCodexSession(params) {
 						throw new Error("Codex fork subscription ownership could not be acquired");
 					}
 					assertCurrent();
-					if (response.model !== model || response.thread.model !== model || response.modelProvider !== modelProvider || response.thread.modelProvider !== modelProvider) throw new Error("Codex fork did not preserve the exact canonical source and selected native model");
+					if (response.model !== model || response.thread.model !== model || response.modelProvider !== modelProvider || response.thread.modelProvider !== modelProvider) throw new Error("Codex fork did not preserve the exact source session and selected native model");
 					const turns = await listCodexUpstreamTurns(control, freshThreadId);
 					assertCurrent();
 					const cut = resolved.canonical.turns.findIndex((turn) => turn.id === resolved.boundary.beforeTurnId);
 					if (cut < 0 || !isDeepStrictEqual(turns, resolved.canonical.turns.slice(0, cut))) throw new Error("Codex did not apply the exact beforeTurnId cut. Reconnect to a compatible server and retry.");
-					const metadata = response.thread.path ? await readCodexSessionMeta(context.localSessionsRoot, response.thread.path, freshThreadId) : void 0;
+					const childMetadata = response.thread.path ? await readCodexSessionMeta(context.localSessionsRoot, response.thread.path, freshThreadId) : void 0;
 					assertCurrent();
-					if (!metadata || metadata.model_provider !== modelProvider) throw new Error("The fresh Codex fork metadata could not be verified");
-					const childCatalog = parseCodexNativeToolCatalog(metadata, freshThreadId);
+					if (!childMetadata || childMetadata.model_provider !== modelProvider) throw new Error("The fresh Codex fork metadata could not be verified");
+					const childCatalog = parseCodexNativeToolCatalog(childMetadata, freshThreadId);
 					if (!isDeepStrictEqual(sourceCatalog, childCatalog)) throw new Error("Codex fork did not preserve the actual native tool catalog");
-					await snapshot.assertUnchanged();
-					assertCurrent();
 					await checkCodexThreadAppAvailability({
 						client: context.client,
 						threadId: freshThreadId,
 						appIds: prepared.provisionalAppIds
 					});
 					assertCurrent();
-					await resolved.canonical.assertUnchanged();
-					assertCurrent();
 					try {
 						await refreshCodexThreadPolicy({
 							client: context.client,
@@ -673,19 +513,18 @@ async function forkCanonicalCodexSession(params) {
 						}
 						throw error;
 					}
-					const appended = await appendSessionTranscriptMessagesByIdentity({
+					await appendSessionTranscriptMessagesByIdentity({
 						config,
 						storePath: resolveStorePath(config.session?.store, { agentId: created.agentId }),
 						agentId: created.agentId,
 						sessionKey: created.key,
 						sessionId: created.sessionId,
 						messages: resolved.canonical.prefix.map((entry) => ({
-							message: structuredClone(entry.message),
+							message: entry.message,
 							idempotencyLookup: "scan"
 						}))
 					});
 					assertCurrent();
-					if (appended.length !== resolved.canonical.prefix.length || appended.some((item, index) => !item.appended || !isDeepStrictEqual(item.message, resolved.canonical.prefix[index]?.message) || index > 0 && item.effectiveParentId !== appended[index - 1]?.messageId)) throw new Error("The canonical Codex display prefix could not be copied completely");
 					await initialization.linkAsync({
 						sessionKey: created.key,
 						agentId: created.agentId,
@@ -719,8 +558,6 @@ async function forkCanonicalCodexSession(params) {
 					await ownership.release(freshThreadId, assertCurrent);
 					subscriptionReleased = true;
 					initialization.assertCurrent();
-					await resolved.canonical.assertUnchanged();
-					initialization.assertCurrent();
 					if (!isDeepStrictEqual(bindingStore.read(sourceIdentity), sourceBinding)) throw new Error("Codex source binding changed before fork readiness");
 					initialization.assertCurrent();
 					return { pluginExtensions: created.entry.pluginExtensions };
@@ -748,7 +585,7 @@ async function forkCodexUpstreamSession(params, options) {
 		const requestControl = sourceFingerprint ? await options.controlFactory.forUpstream(params.source.agentId, sourceFingerprint) : void 0;
 		if (!sourceFingerprint || !requestControl) return unavailable(UNAVAILABLE_CONNECTION_MESSAGE);
 		return await requestControl.withPinnedConnection(async (control) => {
-			const sourceBinding = options.bindingStore.read(sessionBindingIdentity({
+			const sourceBinding = await options.bindingStore.readAsync(sessionBindingIdentity({
 				...params.source,
 				config: options.resolveConfig?.()
 			}));
@@ -792,16 +629,6 @@ async function forkCodexUpstreamSession(params, options) {
 				harnessRuntimeId: options.harnessRuntimeId,
 				config: options.resolveConfig?.() ?? {}
 			});
-			const liveTurns = await listCodexUpstreamTurns(control, sourceThreadId);
-			const precheck = precheckCodexUpstreamForkBoundary({
-				boundary: resolved.boundary,
-				turns: liveTurns
-			});
-			if (!precheck.ok) return {
-				status: "failed",
-				code: precheck.code,
-				message: precheck.message
-			};
 			let response;
 			let threadId;
 			try {

package/dist/.setup/{usage-limit-error-BQX8RHAd.mjs → usage-limit-error-DcOSH3J4.mjs}

@@ -1,7 +1,7 @@
-import { i as isJsonObject } from "./protocol-CANUwXJ3.mjs";
-import { a as shouldRefreshCodexRateLimitsForUsageLimitMessage, i as resolveCodexUsageLimitResetAtMs, n as formatCodexUsageLimitErrorMessage } from "./rate-limits-CI8pTPqL.mjs";
-import { t as CODEX_CONTROL_METHODS } from "./capabilities-DbOzOglY.mjs";
-import { Q as rememberCodexRateLimitsRead, X as readCodexRateLimitsRevision, Z as readRecentCodexRateLimits } from "./shared-client-BCx1wbyA.mjs";
+import { r as isJsonObject } from "./protocol-CaPAVwe9.mjs";
+import { a as shouldRefreshCodexRateLimitsForUsageLimitMessage, i as resolveCodexUsageLimitResetAtMs, n as formatCodexUsageLimitErrorMessage } from "./rate-limits-BpfURnuy.mjs";
+import { t as CODEX_CONTROL_METHODS } from "./capabilities-DAS-JX1z.mjs";
+import { G as rememberCodexRateLimitsRead, U as readCodexRateLimitsRevision, W as readRecentCodexRateLimits } from "./shared-client-CE_uY0A1.mjs";
 import { readStringField } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { markAuthProfileBlockedUntil } from "openclaw/plugin-sdk/agent-runtime";
 import { embeddedAgentLog, formatErrorMessage } from "openclaw/plugin-sdk/agent-harness-runtime";

package/dist/.setup/{usage-C2Kq7oej.mjs → usage-w_93wnnR.mjs}

@@ -1,7 +1,7 @@
-import { t as buildCodexAppServerUsageSnapshot } from "./rate-limits-CI8pTPqL.mjs";
-import { t as readCodexAppServerUsage } from "./request-Bo0kKABI.mjs";
-import "./config-C1YVVLEA.mjs";
-import { n as resolveCodexAppServerRuntimeOptions } from "./config-runtime-DWzK-k0n.mjs";
+import { t as buildCodexAppServerUsageSnapshot } from "./rate-limits-BpfURnuy.mjs";
+import { t as readCodexAppServerUsage } from "./request-ePeNJrOd.mjs";
+import "./config-BfrAlTMT.mjs";
+import { n as resolveCodexAppServerRuntimeOptions } from "./config-runtime-BZRizyuG.mjs";
 import { CODEX_APP_SERVER_AUTH_MARKER } from "openclaw/plugin-sdk/agent-runtime";
 //#region extensions/codex/src/app-server/usage.ts
 /** Handles the synthetic usage credential for a Codex-backed OpenAI route. */

package/dist/.setup/{web-search-item-CvokaZOo.mjs → web-search-item-DHVuNSqk.mjs}

@@ -1,4 +1,4 @@
-import { i as isJsonObject } from "./protocol-CANUwXJ3.mjs";
+import { r as isJsonObject } from "./protocol-CaPAVwe9.mjs";
 import { normalizeOptionalString, normalizeTrimmedStringList } from "openclaw/plugin-sdk/string-coerce-runtime";
 //#region extensions/codex/src/app-server/web-search-item.ts
 function projectCodexWebSearchItem(item) {

package/dist/.setup/{web-search-provider.runtime-D89djc7e.mjs → web-search-provider.runtime-DMHxve5v.mjs}

@@ -1,6 +1,6 @@
-import { m as buildCodexNativeWebSearchThreadConfig } from "./thread-requests-BgzJwJtS.mjs";
-import { runBoundedCodexAppServerTurn } from "./bounded-turn-DfIJtRlv.mjs";
-import { t as projectCodexWebSearchItem } from "./web-search-item-CvokaZOo.mjs";
+import { m as buildCodexNativeWebSearchThreadConfig } from "./thread-requests-BjawdIVV.mjs";
+import { runBoundedCodexAppServerTurn } from "./bounded-turn-mN_ekXYW.mjs";
+import { t as projectCodexWebSearchItem } from "./web-search-item-DHVuNSqk.mjs";
 import { readStringParam, resolveSearchTimeoutSeconds, wrapWebContent } from "openclaw/plugin-sdk/provider-web-search";
 //#region extensions/codex/src/web-search-provider.runtime.ts
 async function executeCodexWebSearchProviderTool(ctx, args, executionContext, options) {

package/dist/.setup/{workspace-write-sandbox-probe-BDWO2Qkh.mjs → workspace-write-sandbox-probe-DJxOXcF3.mjs}

@@ -1,6 +1,6 @@
 import { a as resolveCodexPrivateLauncher, n as isCodexAppServerProxyLaunch } from "./launch-args-DbFCehO7.mjs";
-import { n as resolveCodexAppServerSpawnEnv, r as resolveCodexAppServerSpawnInvocation } from "./transport-stdio-CRWTkKOn.mjs";
-import { t as resolveCodexDoctorStartOptions } from "./doctor-start-options-JjTAl-q_.mjs";
+import { n as resolveCodexAppServerSpawnEnv, r as resolveCodexAppServerSpawnInvocation } from "./transport-stdio-Bq160Dhv.mjs";
+import { t as resolveCodexDoctorStartOptions } from "./doctor-start-options-8uIBXIzR.mjs";
 import { runUtf8CommandWithTimeout } from "openclaw/plugin-sdk/process-runtime";
 import path from "node:path";
 import fs from "node:fs/promises";

package/dist/api.js

@@ -1,15 +1,12 @@
-import { i as resolveManagedCodexNativeCommand, s as CODEX_APP_SERVER_VERSION } from "./.setup/managed-binary-BtIjV7yN.mjs";
-import { t as codexNativeProfileRecoveryHealthCheck } from "./.setup/auth-profile-health-oHizqgye.mjs";
+import { f as resolveManagedCodexNativeCommand, g as CODEX_APP_SERVER_VERSION, m as runCodexVersionCommand, s as parseCodexVersion, t as CODEX_VERSION_TIMEOUT_MS } from "./.setup/managed-binary-DbKvGXKl.mjs";
+import { t as codexNativeProfileRecoveryHealthCheck } from "./.setup/auth-profile-health-BVPZU9I8.mjs";
 import { n as findCodexAppServerSpawnError, t as describeCodexSpawnError } from "./.setup/spawn-error-CL3n6MAa.mjs";
-import { t as resolveCodexDoctorStartOptions } from "./.setup/doctor-start-options-JjTAl-q_.mjs";
-import { runUtf8CommandWithTimeout } from "openclaw/plugin-sdk/process-runtime";
+import { t as resolveCodexDoctorStartOptions } from "./.setup/doctor-start-options-8uIBXIzR.mjs";
 import path from "node:path";
 import { coerceErrorMessage } from "openclaw/plugin-sdk/error-runtime";
 import { fileURLToPath } from "node:url";
 //#region extensions/codex/src/doctor.ts
 const CODEX_MANAGED_APP_SERVER_CHECK_ID = "codex/managed-app-server";
-const CODEX_VERSION_TIMEOUT_MS = 5e3;
-const CODEX_VERSION_MAX_BUFFER_BYTES = 65536;
 function managedCodexFindings(params) {
 	return [{
 		checkId: CODEX_MANAGED_APP_SERVER_CHECK_ID,
@@ -21,30 +18,12 @@ function managedCodexFindings(params) {
 		...params.fixHint ? { fixHint: params.fixHint } : {}
 	}];
 }
-function parseCodexVersion(output) {
-	return /(?:^|\s)(\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?)(?:\s|$)/u.exec(output)?.[1];
-}
-async function runVersionCommand(command, env) {
-	const result = await runUtf8CommandWithTimeout([command, "--version"], {
-		baseEnv: env,
-		input: "",
-		timeoutMs: CODEX_VERSION_TIMEOUT_MS,
-		maxOutputBytes: CODEX_VERSION_MAX_BUFFER_BYTES,
-		outputCapture: "head",
-		terminateOnOutputLimit: true,
-		killProcessTree: true,
-		killSignal: "SIGKILL",
-		killGraceMs: 0
-	});
-	if (result.termination !== "exit" || result.code !== 0 || result.outputLimitExceeded) throw new Error(result.outputLimitExceeded ? "Version output exceeded its capture limit" : result.termination === "timeout" ? `Version check timed out after ${CODEX_VERSION_TIMEOUT_MS} ms` : `Version check failed (${result.signal ?? result.code ?? result.termination})`);
-	return result;
-}
 function createCodexManagedAppServerHealthCheck(params) {
 	const resolveNativeCommand = params.deps?.resolveNativeCommand ?? resolveManagedCodexNativeCommand;
 	return {
 		id: CODEX_MANAGED_APP_SERVER_CHECK_ID,
 		kind: "plugin",
-		description: "Verify the selected managed Codex app-server binary and pinned version.",
+		description: "Verify the shipped managed Codex app-server binary and pinned version.",
 		source: "codex",
 		defaultEnabled: false,
 		async detect(ctx) {
@@ -80,7 +59,7 @@ function createCodexManagedAppServerHealthCheck(params) {
 			});
 			let output;
 			try {
-				output = await (params.deps?.runVersionCommand ? params.deps.runVersionCommand(nativeCommand) : runVersionCommand(nativeCommand, env));
+				output = await (params.deps?.runVersionCommand ? params.deps.runVersionCommand(nativeCommand) : runCodexVersionCommand(nativeCommand, env));
 			} catch (error) {
 				const spawnFailure = findCodexAppServerSpawnError(describeCodexSpawnError(error, nativeCommand));
 				return managedCodexFindings({
@@ -91,7 +70,7 @@ function createCodexManagedAppServerHealthCheck(params) {
 					fixHint: versionFailureHint ?? "Repair or reinstall the staged OpenClaw package, then rerun the candidate check before cutover."
 				});
 			}
-			const detectedVersion = parseCodexVersion(`${output.stdout}\n${output.stderr}`);
+			const detectedVersion = parseCodexVersion(output);
 			if (detectedVersion !== "0.160.0") return managedCodexFindings({
 				severity: versionFailureSeverity,
 				message: detectedVersion ? `Managed Codex app-server version mismatch: expected ${CODEX_APP_SERVER_VERSION}, detected ${detectedVersion}.` : `Managed Codex app-server did not report a parseable version; expected ${CODEX_APP_SERVER_VERSION}.`,
@@ -115,7 +94,7 @@ function registerCodexManagedAppServerDoctorChecks$1(host, deps) {
 const CODEX_PLUGIN_ROOT = path.dirname(fileURLToPath(import.meta.url));
 async function probeCodexWorkspaceWriteSandbox(params) {
 	try {
-		const { probeCodexWorkspaceWriteSandbox: probe } = await import("./.setup/workspace-write-sandbox-probe-BDWO2Qkh.mjs");
+		const { probeCodexWorkspaceWriteSandbox: probe } = await import("./.setup/workspace-write-sandbox-probe-DJxOXcF3.mjs");
 		return await probe({
 			...params,
 			pluginRoot: CODEX_PLUGIN_ROOT

package/dist/catalog-page.worker.js

@@ -1,4 +1,4 @@
-import { t as createCodexCatalogDecoder } from "./.setup/client-catalog-response-CuVLp4I0.mjs";
+import { t as createCodexCatalogDecoder } from "./.setup/client-catalog-response-jM38o5w1.mjs";
 import { serveWorkerTasks } from "openclaw/plugin-sdk/worker-task-server";
 //#region extensions/codex/catalog-page.worker.ts
 const decode = createCodexCatalogDecoder();

package/dist/cli-metadata.js

@@ -2,7 +2,7 @@ import { definePluginEntry } from "openclaw/plugin-sdk/plugin-entry";
 //#region extensions/codex/cli-metadata.ts
 function registerCodexCliMetadata(api) {
 	api.registerCli(async ({ program }) => {
-		const { registerCodexSessionCli } = await import("./.setup/session-cli-GwU0izn-.mjs");
+		const { registerCodexSessionCli } = await import("./.setup/session-cli-CBGKiqdv.mjs");
 		registerCodexSessionCli(program);
 	}, { descriptors: [{
 		name: "codex",

package/dist/client-version-api.js

@@ -0,0 +1,25 @@
+import { a as resolveCodexAppServerStartOptionsForAgent } from "./.setup/config-options-DMFZkd3X.mjs";
+import { d as resolveManagedCodexClientVersion, g as CODEX_APP_SERVER_VERSION } from "./.setup/managed-binary-DbKvGXKl.mjs";
+import "./.setup/config-BfrAlTMT.mjs";
+import { n as resolveCodexAppServerRuntimeOptions } from "./.setup/config-runtime-BZRizyuG.mjs";
+//#region extensions/codex/client-version-api.ts
+/**
+* Codex client version for ChatGPT model discovery: the version of the binary
+* managed turns run, so listed models match what the backend accepts for them.
+* Custom commands and remote app-servers keep reporting the bundled pin.
+*/
+async function resolveCodexClientVersion(params) {
+	const { start } = resolveCodexAppServerRuntimeOptions({
+		pluginConfig: params.config?.plugins?.entries?.codex?.config,
+		env: params.env
+	});
+	if (start.transport !== "stdio" || start.commandSource !== "managed") return CODEX_APP_SERVER_VERSION;
+	const agentStart = params.agentDir ? resolveCodexAppServerStartOptionsForAgent({
+		startOptions: start,
+		agentDir: params.agentDir,
+		env: params.env
+	}) : start;
+	return resolveManagedCodexClientVersion(agentStart.managedCommandOrder ?? "package-first");
+}
+//#endregion
+export { resolveCodexClientVersion };

package/dist/doctor-contract-api.js

@@ -248,15 +248,15 @@ const stateMigrations = [
 	{
 		id: "codex-app-server-sidecars-to-plugin-state",
 		label: "Codex app-server thread bindings",
-		detectLegacyState: async (params) => (await import("./.setup/session-binding-sidecars-DD-enC8w.mjs")).detectLegacySessionBindingSidecars(params),
-		migrateLegacyState: async (params) => (await import("./.setup/session-binding-sidecars-DD-enC8w.mjs")).migrateLegacySessionBindingSidecars(params)
+		detectLegacyState: async (params) => (await import("./.setup/session-binding-sidecars-BNSS6WL4.mjs")).detectLegacySessionBindingSidecars(params),
+		migrateLegacyState: async (params) => (await import("./.setup/session-binding-sidecars-BNSS6WL4.mjs")).migrateLegacySessionBindingSidecars(params)
 	},
 	{
 		id: "codex-native-task-assignments",
 		label: "Codex native pending assignments",
-		collectBackupResources: async (params) => (await import("./.setup/native-task-assignments-DimsQ9Qa.mjs")).codexNativeTaskAssignmentMigration.collectBackupResources(params),
-		detectLegacyState: async (params) => (await import("./.setup/native-task-assignments-DimsQ9Qa.mjs")).codexNativeTaskAssignmentMigration.detectLegacyState(params),
-		migrateLegacyState: async (params) => (await import("./.setup/native-task-assignments-DimsQ9Qa.mjs")).codexNativeTaskAssignmentMigration.migrateLegacyState(params)
+		collectBackupResources: async (params) => (await import("./.setup/native-task-assignments-YJopbaVO.mjs")).codexNativeTaskAssignmentMigration.collectBackupResources(params),
+		detectLegacyState: async (params) => (await import("./.setup/native-task-assignments-YJopbaVO.mjs")).codexNativeTaskAssignmentMigration.detectLegacyState(params),
+		migrateLegacyState: async (params) => (await import("./.setup/native-task-assignments-YJopbaVO.mjs")).codexNativeTaskAssignmentMigration.migrateLegacyState(params)
 	},
 	codexOrphanedSessionBindingMigration
 ];