@openclaw/codex 2026.10.5-beta.4 → 2026.10.5

package/dist/.setup/{account-usage-runtime-CoVpNIlD.mjs → account-usage-runtime-Dqpnnkst.mjs}

@@ -1,8 +1,8 @@
 import { n as isCodexAppServerProxyLaunch } from "./launch-args-DbFCehO7.mjs";
 import { t as buildCodexAppServerUsageSnapshot } from "./rate-limits-CI8pTPqL.mjs";
-import { t as readCodexAppServerUsage } from "./request-Bo0kKABI.mjs";
-import "./config-C1YVVLEA.mjs";
-import { n as resolveCodexAppServerRuntimeOptions } from "./config-runtime-DWzK-k0n.mjs";
+import { t as readCodexAppServerUsage } from "./request-DhbisYCc.mjs";
+import "./config-G4IGX6bK.mjs";
+import { n as resolveCodexAppServerRuntimeOptions } from "./config-runtime-B8agjie6.mjs";
 import { a as resolveCodexAppServerAuthProfileStore } from "./auth-profile-CgHQ8Vot.mjs";
 import { isDeepStrictEqual } from "node:util";
 import { listAgentIds, resolveAgentDir } from "openclaw/plugin-sdk/agent-scope-runtime";

package/dist/.setup/{app-server-policy-D_zv8J7V.mjs → app-server-policy-XTIa6h5k.mjs}

@@ -1,4 +1,4 @@
-import { n as canUseCodexModelBackedApprovalsReviewerForModel } from "./config-C1YVVLEA.mjs";
+import { n as canUseCodexModelBackedApprovalsReviewerForModel } from "./config-G4IGX6bK.mjs";
 //#region extensions/codex/src/app-server/app-server-policy.ts
 function resolveCodexAppServerForModelProvider(params) {
 	return params.appServer.approvalsReviewer === "user" || canUseCodexModelBackedApprovalsReviewerForModel({

package/dist/.setup/{apply-BXDMd05l.mjs → apply-QyZT5-na.mjs}

@@ -1,13 +1,13 @@
-import { s as resolveCodexAppServerFallbackApiKeyCacheKey } from "./auth-cache-key-f8ODJ_OX.mjs";
+import { s as resolveCodexAppServerFallbackApiKeyCacheKey } from "./auth-cache-key-DvDLHVJe.mjs";
 import { a as defaultCodexAppInventoryCache, r as buildCodexPluginAppCacheKey } from "./plugin-app-cache-key-Bg9DbDI6.mjs";
-import { r as requestCodexAppServerJson } from "./request-Bo0kKABI.mjs";
-import { r as isOpenAiCuratedMarketplaceName, u as CODEX_PLUGINS_MARKETPLACE_NAME } from "./plugin-inventory-CYgdo14P.mjs";
-import "./config-C1YVVLEA.mjs";
-import { n as resolveCodexAppServerRuntimeOptions } from "./config-runtime-DWzK-k0n.mjs";
+import { r as requestCodexAppServerJson } from "./request-DhbisYCc.mjs";
+import { r as isOpenAiCuratedMarketplaceName, u as CODEX_PLUGINS_MARKETPLACE_NAME } from "./plugin-inventory-kLR7G02h.mjs";
+import "./config-G4IGX6bK.mjs";
+import { n as resolveCodexAppServerRuntimeOptions } from "./config-runtime-B8agjie6.mjs";
 import { i as resolveCodexAppServerAuthProfileIdForAgent } from "./auth-profile-CgHQ8Vot.mjs";
-import { c as getLeasedSharedCodexAppServerClient, h as releaseLeasedSharedCodexAppServerClient, o as clearSharedCodexAppServerClientIfCurrentAndWait, tt as resolveCodexAppServerAuthAccountCacheKey } from "./shared-client-BCx1wbyA.mjs";
-import { t as ensureCodexPluginActivation } from "./plugin-activation-D7WkJMvU.mjs";
-import { CODEX_PLUGIN_CONFIG_PATH, buildCodexMigrationPlan, buildCodexPluginsConfigValue, hasCodexPluginConfigConflict, n as resolveCodexConfigPatchMode, readCodexPluginMigrationConfigEntry, t as createCodexAuthItemApplier } from "./plan-41-YOBMq.mjs";
+import { c as getLeasedSharedCodexAppServerClient, h as releaseLeasedSharedCodexAppServerClient, o as clearSharedCodexAppServerClientIfCurrentAndWait, tt as resolveCodexAppServerAuthAccountCacheKey } from "./shared-client-wb1JBldZ.mjs";
+import { t as ensureCodexPluginActivation } from "./plugin-activation-CsW09DWl.mjs";
+import { CODEX_PLUGIN_CONFIG_PATH, buildCodexMigrationPlan, buildCodexPluginsConfigValue, hasCodexPluginConfigConflict, n as resolveCodexConfigPatchMode, readCodexPluginMigrationConfigEntry, t as createCodexAuthItemApplier } from "./plan-DZWYASAx.mjs";
 import { uniqueStrings } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { parseStrictNonNegativeInteger } from "openclaw/plugin-sdk/number-runtime";
 import path from "node:path";

package/dist/.setup/{attempt-client-cleanup-zNuNTKVr.mjs → attempt-client-cleanup-TScCVTsk.mjs}

@@ -1,9 +1,9 @@
-import { w as retireSharedCodexAppServerClientIfCurrent } from "./auth-cache-key-f8ODJ_OX.mjs";
+import { w as retireSharedCodexAppServerClientIfCurrent } from "./auth-cache-key-DvDLHVJe.mjs";
 import { a as codexPrewriteRejectionCause, o as isCodexAppServerOverloadError, r as CodexAppServerRpcError } from "./rpc-error-C98SHchT.mjs";
-import { Y as unsubscribeCodexAppServerLiveThread, pt as isCodexAppServerStartupError, u as isCodexAppServerStartSelectionChangedError } from "./shared-client-BCx1wbyA.mjs";
-import { I as isCodexAppServerBrokenPipeError, c as isCodexAppServerRequestTimeoutError } from "./client-D93nbdB8.mjs";
-import { n as getCodexAppServerTurnRouter } from "./turn-router-DBVMToGo.mjs";
-import { t as __exportAll } from "./session-binding-sidecars-DD-enC8w.mjs";
+import { Y as unsubscribeCodexAppServerLiveThread, pt as isCodexAppServerStartupError, u as isCodexAppServerStartSelectionChangedError } from "./shared-client-wb1JBldZ.mjs";
+import { I as isCodexAppServerBrokenPipeError, c as isCodexAppServerRequestTimeoutError } from "./client-BpSxNz4F.mjs";
+import { n as getCodexAppServerTurnRouter } from "./turn-router-DdlzuFdm.mjs";
+import { t as __exportAll } from "./session-binding-sidecars-DijNZb31.mjs";
 import { createDeferred } from "openclaw/plugin-sdk/extension-shared";
 import { AgentHarnessPreflightError, embeddedAgentLog } from "openclaw/plugin-sdk/agent-harness-runtime";
 //#region extensions/codex/src/app-server/attempt-client-cleanup.ts

package/dist/.setup/attempt-terminal-sZutF0WY.mjs

@@ -0,0 +1 @@
+export { agentHarnessAttemptTerminal as t } from "openclaw/plugin-sdk/agent-harness-runtime";

package/dist/.setup/{attempt-workspace-context-CcwP3DA3.mjs → attempt-workspace-context-Cr3mI4vp.mjs}

@@ -1,5 +1,5 @@
 import { r as flattenCodexDynamicToolFunctions } from "./protocol-CANUwXJ3.mjs";
-import { I as isMessageOnlyCodexSourceReply } from "./thread-requests-BgzJwJtS.mjs";
+import { I as isMessageOnlyCodexSourceReply } from "./thread-requests-BqPhA4Gs.mjs";
 import { normalizeLowercaseStringOrEmpty } from "openclaw/plugin-sdk/string-coerce-runtime";
 import path from "node:path";
 import { buildAgentWorkspaceInstructionSnapshot, buildBootstrapContextForFiles, embeddedAgentLog, prepareAgentWorkspaceContext } from "openclaw/plugin-sdk/agent-harness-runtime";

package/dist/.setup/{auth-binding-BaxlhaNx.mjs → auth-binding-BFTkrP_b.mjs}

@@ -1,5 +1,5 @@
 import { i as isCodexResponsesOAuthCredential, o as resolveCodexResponsesOAuthProfileFingerprint } from "./responses-oauth-twnuTaAa.mjs";
-import { t as __exportAll } from "./session-binding-sidecars-DD-enC8w.mjs";
+import { t as __exportAll } from "./session-binding-sidecars-DijNZb31.mjs";
 import { resolveApiKeyForProfile } from "openclaw/plugin-sdk/agent-runtime";
 import { fingerprintResolvedAuthProfileCredential } from "openclaw/plugin-sdk/agent-harness-runtime";
 import { resolveOpenAICodexAuthIdentity } from "openclaw/plugin-sdk/provider-auth";

package/dist/.setup/{auth-cache-key-f8ODJ_OX.mjs → auth-cache-key-DvDLHVJe.mjs}

@@ -1,6 +1,6 @@
-import { n as defineCodexBuildState } from "./build-state-Ds14X10-.mjs";
-import { u as resolveMacOSDesktopCodexAppPathCandidates } from "./managed-binary-BtIjV7yN.mjs";
-import { n as resolveCodexAppServerSpawnEnv } from "./transport-stdio-CRWTkKOn.mjs";
+import { n as defineCodexBuildState } from "./build-state-DfrctLQv.mjs";
+import { u as resolveMacOSDesktopCodexAppPathCandidates } from "./managed-binary-DwC9wxch.mjs";
+import { n as resolveCodexAppServerSpawnEnv } from "./transport-stdio-lgeKKHyw.mjs";
 import { isRecord, normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { createHash } from "node:crypto";
 import fs, { constants, existsSync, watch } from "node:fs";

package/dist/.setup/{binding-connection-B7HAAZSI.mjs → binding-connection-X1ZeEDz8.mjs}

@@ -1,4 +1,4 @@
-import { t as __exportAll } from "./session-binding-sidecars-DD-enC8w.mjs";
+import { t as __exportAll } from "./session-binding-sidecars-DijNZb31.mjs";
 import { AgentHarnessPreflightError } from "openclaw/plugin-sdk/agent-harness-registration";
 import { createPluginRuntimeStore } from "openclaw/plugin-sdk/runtime-store";
 //#region extensions/codex/src/app-server/binding-connection.ts
@@ -44,7 +44,7 @@ function requireCodexSupervisionModelSelection(binding) {
 }
 /** Registration publishes the resolver; connection policy loads only for an actual request. */
 async function resolveCodexBindingAppServerConnection(params) {
-	return (await import("./binding-connection.runtime-DAXn7iFl.mjs")).resolveCodexBindingAppServerConnection(params, catalogHomes.tryGetRuntime());
+	return (await import("./binding-connection.runtime-CZSz0g4u.mjs")).resolveCodexBindingAppServerConnection(params, catalogHomes.tryGetRuntime());
 }
 //#endregion
 export { setCodexCatalogConnectionHomeResolver as a, resolveCodexBindingAppServerConnection as i, binding_connection_exports as n, requireCodexSupervisionModelSelection as r, assertCodexSessionRuntimeOwnership as t };

package/dist/.setup/{binding-connection.runtime-DAXn7iFl.mjs → binding-connection.runtime-CZSz0g4u.mjs}

@@ -1,7 +1,7 @@
-import { d as readCodexPluginConfig } from "./config-parsing-DsWSCPHO.mjs";
+import { d as readCodexPluginConfig } from "./config-parsing-CVK2Q463.mjs";
 import { n as resolveCodexAppServerLocalHomeDir } from "./auth-start-options-BPIPeEX8.mjs";
 import { t as buildCodexAppServerConnectionFingerprint } from "./plugin-app-cache-key-Bg9DbDI6.mjs";
-import { n as resolveCodexAppServerRuntimeOptions, r as resolveCodexSupervisionAppServerRuntimeOptions } from "./config-runtime-DWzK-k0n.mjs";
+import { n as resolveCodexAppServerRuntimeOptions, r as resolveCodexSupervisionAppServerRuntimeOptions } from "./config-runtime-B8agjie6.mjs";
 //#region extensions/codex/src/app-server/binding-connection.runtime.ts
 /** Resolves connection and auth ownership exclusively from the private thread binding. */
 async function resolveCodexBindingAppServerConnection(params, discoverHomes) {

package/dist/.setup/{bounded-turn-DfIJtRlv.mjs → bounded-turn-BpjZixcd.mjs}

@@ -1,18 +1,18 @@
 import { i as isJsonObject } from "./protocol-CANUwXJ3.mjs";
 import { a as resolveCodexPrivateLauncher, i as readCodexAppServerConfigOptions } from "./launch-args-DbFCehO7.mjs";
-import { d as readCodexEffectiveConfig } from "./config-options-DDzeNQ8m.mjs";
+import { d as readCodexEffectiveConfig } from "./config-options-nvYwVDyy.mjs";
 import { a as codexPrewriteRejectionCause } from "./rpc-error-C98SHchT.mjs";
-import "./config-C1YVVLEA.mjs";
-import { n as resolveCodexAppServerRuntimeOptions } from "./config-runtime-DWzK-k0n.mjs";
-import { u as isCodexAppServerStartSelectionChangedError } from "./shared-client-BCx1wbyA.mjs";
-import { _ as assertCodexTurnStartResponse, b as readCodexErrorNotification, g as assertCodexThreadStartResponse, w as createCodexElicitationResponse } from "./client-D93nbdB8.mjs";
-import { o as closeCodexStartupClientBestEffort, s as interruptCodexTurnAndWaitBestEffort, t as CODEX_APP_SERVER_INTERRUPT_TIMEOUT_MS } from "./attempt-client-cleanup-zNuNTKVr.mjs";
-import { t as CodexEphemeralTurn } from "./ephemeral-turn-De3qb8EQ.mjs";
-import { i as readModelListResult } from "./models-BHpbAuz8.mjs";
-import { d as mergeCodexThreadConfigs } from "./project-doc-thread-config-BVcvnps8.mjs";
+import "./config-G4IGX6bK.mjs";
+import { n as resolveCodexAppServerRuntimeOptions } from "./config-runtime-B8agjie6.mjs";
+import { u as isCodexAppServerStartSelectionChangedError } from "./shared-client-wb1JBldZ.mjs";
+import { _ as assertCodexTurnStartResponse, b as readCodexErrorNotification, g as assertCodexThreadStartResponse, w as createCodexElicitationResponse } from "./client-BpSxNz4F.mjs";
+import { o as closeCodexStartupClientBestEffort, s as interruptCodexTurnAndWaitBestEffort, t as CODEX_APP_SERVER_INTERRUPT_TIMEOUT_MS } from "./attempt-client-cleanup-TScCVTsk.mjs";
+import { t as CodexEphemeralTurn } from "./ephemeral-turn-C6aFeGFS.mjs";
+import { i as readModelListResult } from "./models-GBLXb27n.mjs";
+import { d as mergeCodexThreadConfigs } from "./project-doc-thread-config-B2ZD23A_.mjs";
 import { n as resolveCodexAppServerReasoningEffort } from "./reasoning-effort-CS9kKWB9.mjs";
-import { n as buildCodexRingZeroThreadConfigPatch, p as attestCodexRestrictedToolSurfaceMcpServersDisabled, r as buildCodexRuntimeThreadConfig, t as assertCodexManagedRequirementsDoNotOverrideToolPolicy, u as readCodexInheritedMcpServerNames } from "./thread-requests-BgzJwJtS.mjs";
-import { a as resolveCodexPromptError } from "./usage-limit-error-BQX8RHAd.mjs";
+import { n as buildCodexRingZeroThreadConfigPatch, p as attestCodexRestrictedToolSurfaceMcpServersDisabled, r as buildCodexRuntimeThreadConfig, t as assertCodexManagedRequirementsDoNotOverrideToolPolicy, u as readCodexInheritedMcpServerNames } from "./thread-requests-BqPhA4Gs.mjs";
+import { a as resolveCodexPromptError } from "./usage-limit-error-hLIGKewV.mjs";
 import { resolveTimerTimeoutMs } from "openclaw/plugin-sdk/number-runtime";
 import { parse } from "smol-toml";
 import path from "node:path";
@@ -146,7 +146,7 @@ async function runBoundedCodexAppServerTurnInWorkspace(params, appServer, worksp
 		assertCurrent: params.assertCurrent,
 		...params.signal ? { abandonSignal: params.signal } : {}
 	};
-	const client = params.options.clientFactory ? await params.options.clientFactory(clientOptions) : await import("./shared-client-BCx1wbyA.mjs").then((n) => n.v).then(({ createIsolatedCodexAppServerClient }) => createIsolatedCodexAppServerClient({
+	const client = params.options.clientFactory ? await params.options.clientFactory(clientOptions) : await import("./shared-client-wb1JBldZ.mjs").then((n) => n.v).then(({ createIsolatedCodexAppServerClient }) => createIsolatedCodexAppServerClient({
 		...clientOptions,
 		authProfileStore: params.authProfileStore
 	}));

package/dist/.setup/{bounded-turn-isolation-BfDAo-qZ.mjs → bounded-turn-isolation-Brj5qzz6.mjs}

@@ -1,8 +1,8 @@
-import { d as readCodexPluginConfig } from "./config-parsing-DsWSCPHO.mjs";
+import { d as readCodexPluginConfig } from "./config-parsing-CVK2Q463.mjs";
 import { n as isCodexAppServerProxyLaunch } from "./launch-args-DbFCehO7.mjs";
-import { i as resolveCodexAppServerHomeScope } from "./config-options-DDzeNQ8m.mjs";
-import "./config-C1YVVLEA.mjs";
-import { n as resolveCodexAppServerRuntimeOptions } from "./config-runtime-DWzK-k0n.mjs";
+import { i as resolveCodexAppServerHomeScope } from "./config-options-nvYwVDyy.mjs";
+import "./config-G4IGX6bK.mjs";
+import { n as resolveCodexAppServerRuntimeOptions } from "./config-runtime-B8agjie6.mjs";
 //#region extensions/codex/src/app-server/bounded-turn-isolation.ts
 function resolveCodexBoundedTurnIsolation(options) {
 	const pluginConfig = readCodexPluginConfig(options.pluginConfig);

package/dist/.setup/{build-state-Ds14X10-.mjs → build-state-DfrctLQv.mjs}

@@ -1,5 +1,5 @@
 //#region extensions/codex/package.json
-var version = "2026.10.5-beta.4";
+var version = "2026.10.5";
 //#endregion
 //#region extensions/codex/src/build-state.ts
 /**

package/dist/.setup/{client-D93nbdB8.mjs → client-BpSxNz4F.mjs}

@@ -1,14 +1,14 @@
-import { a as readCodexCatalogDecodeRoute, c as isRpcResponse, i as listenCodexAppServerLines, n as projectCodexCatalogMessage, o as CodexAppServerMessageDecoder, r as createCodexAppServerMessageWriter, s as redactCodexAppServerLinePreview } from "./client-catalog-response-CuVLp4I0.mjs";
+import { a as readCodexCatalogDecodeRoute, c as isRpcResponse, i as listenCodexAppServerLines, n as projectCodexCatalogMessage, o as CodexAppServerMessageDecoder, r as createCodexAppServerMessageWriter, s as redactCodexAppServerLinePreview } from "./client-catalog-response-DloWE31e.mjs";
 import { i as isJsonObject } from "./protocol-CANUwXJ3.mjs";
-import { c as MIN_SUPPORTED_CODEX_APP_SERVER_VERSION, s as CODEX_APP_SERVER_VERSION } from "./managed-binary-BtIjV7yN.mjs";
-import { a as closeCodexAppServerTransport, l as getCodexAppServerRegisteredTransportIdentity, o as closeCodexAppServerTransportAndWait, s as hasCodexAppServerNaturalExit, t as createStdioTransport } from "./transport-stdio-CRWTkKOn.mjs";
+import { c as MIN_SUPPORTED_CODEX_APP_SERVER_VERSION, s as CODEX_APP_SERVER_VERSION } from "./managed-binary-DwC9wxch.mjs";
+import { a as closeCodexAppServerTransportAndWait, c as getCodexAppServerRegisteredTransportIdentity, i as closeCodexAppServerTransport, o as hasCodexAppServerNaturalExit, t as createStdioTransport } from "./transport-stdio-lgeKKHyw.mjs";
 import { i as CodexAppServerScopedRequestRejectedError, n as CodexAppServerLocalRequestCancellationError, o as isCodexAppServerOverloadError, r as CodexAppServerRpcError, t as CODEX_APP_SERVER_OVERLOADED_ERROR_CODE } from "./rpc-error-C98SHchT.mjs";
-import { n as codexCatalogSourceForClient, s as recordCodexCatalogResponseSource, t as closeCodexCatalogClientSource } from "./session-catalog-source-DGuRdGvM.mjs";
-import { i as reuseCodexCatalogPreview } from "./session-catalog-native-projection-CWqCU1I_.mjs";
-import { n as resolveCodexAppServerRuntimeOptions } from "./config-runtime-DWzK-k0n.mjs";
+import { n as codexCatalogSourceForClient, s as recordCodexCatalogResponseSource, t as closeCodexCatalogClientSource } from "./session-catalog-source-CgWkqG43.mjs";
+import { i as reuseCodexCatalogPreview } from "./session-catalog-native-projection-imNPfB3q.mjs";
+import { n as resolveCodexAppServerRuntimeOptions } from "./config-runtime-B8agjie6.mjs";
 import { codexCatalogPageWorkerEntrypoint } from "../catalog-page-worker-entrypoint.js";
-import { t as createWebSocketTransport } from "./transport-websocket-DIyPfkHo.mjs";
-import { t as __exportAll } from "./session-binding-sidecars-DD-enC8w.mjs";
+import { t as createWebSocketTransport } from "./transport-websocket-DOY0dJXN.mjs";
+import { t as __exportAll } from "./session-binding-sidecars-DijNZb31.mjs";
 import { isRecord, normalizeOptionalString, readStringField } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { randomUUID } from "node:crypto";
 import { normalizeJsonSchemaForTypeBox } from "openclaw/plugin-sdk/json-schema-runtime";

package/dist/.setup/{client-catalog-response-CuVLp4I0.mjs → client-catalog-response-DloWE31e.mjs}

@@ -1,5 +1,5 @@
 import { i as isJsonObject } from "./protocol-CANUwXJ3.mjs";
-import { n as projectCodexCatalogNativeResponse, r as projectCodexCatalogNativeThread } from "./session-catalog-native-projection-CWqCU1I_.mjs";
+import { n as projectCodexCatalogNativeResponse, r as projectCodexCatalogNativeThread } from "./session-catalog-native-projection-imNPfB3q.mjs";
 import { embeddedAgentLog } from "openclaw/plugin-sdk/agent-harness-registration";
 import { truncateUtf16Safe } from "openclaw/plugin-sdk/text-utility-runtime";
 import { sanitizeTerminalText } from "openclaw/plugin-sdk/text-chunking";

package/dist/.setup/{command-dispatch-DxdH5a9-.mjs → command-dispatch-CIdf7ZvD.mjs}

@@ -8,7 +8,7 @@ async function handleCodexCommand(ctx, options) {
 	};
 	const { resolvePluginConfig, ...subcommandOptions } = options;
 	try {
-		const { handleCodexSubcommand } = await import("./command-handlers-fiYvYYq0.mjs");
+		const { handleCodexSubcommand } = await import("./command-handlers-C2XNDeHL.mjs");
 		return await handleCodexSubcommand(commandContext, {
 			...subcommandOptions,
 			pluginConfig: resolvePluginConfig?.() ?? subcommandOptions.pluginConfig

package/dist/.setup/{command-handlers-fiYvYYq0.mjs → command-handlers-C2XNDeHL.mjs}

@@ -1,37 +1,37 @@
 import { i as isJsonObject } from "./protocol-CANUwXJ3.mjs";
-import { m as sessionBindingIdentity, n as assertCodexBindingMayBeReplaced, r as bindingStoreKey } from "./session-binding-record-DU_0biMD.mjs";
-import { r as isCodexFastServiceTier } from "./config-utils-DN_YT7dE.mjs";
-import { c as resolveCodexAppServerPreparedApiKeyCacheKey, s as resolveCodexAppServerFallbackApiKeyCacheKey } from "./auth-cache-key-f8ODJ_OX.mjs";
+import { m as sessionBindingIdentity, n as assertCodexBindingMayBeReplaced, r as bindingStoreKey } from "./session-binding-record-C2kDBZhx.mjs";
+import { m as isCodexFastServiceTier } from "./config-parsing-CVK2Q463.mjs";
+import { c as resolveCodexAppServerPreparedApiKeyCacheKey, s as resolveCodexAppServerFallbackApiKeyCacheKey } from "./auth-cache-key-DvDLHVJe.mjs";
 import { n as withCodexConversationThreadActivity } from "./thread-ownership-queue-CeyYScUC.mjs";
 import { a as canMutateCodexHost, i as assertCodexHostOwnerCurrent, n as CODEX_HOST_INSPECTION_AUTH_ERROR, o as hasCodexAdminScope, r as CODEX_NATIVE_EXECUTION_AUTH_ERROR, t as CODEX_FULL_PERMISSIONS_AUTH_ERROR } from "./command-authorization-AikPDtcc.mjs";
 import { l as formatRelativeDuration, s as summarizeCodexAccountUsage } from "./rate-limits-CI8pTPqL.mjs";
 import { a as formatCodexAccountLine, c as formatCodexTextForDisplay, d as formatModels, f as formatSkills, i as formatAccount, l as formatComputerUseStatus, m as isLikelyEmailAddress, n as buildHelp, o as formatCodexDisplayText, p as formatThreads, r as escapeCodexChatText, s as formatCodexStatus, t as CODEX_RESUME_SAFE_THREAD_ID_PATTERN, u as formatList } from "./command-formatters-xW9KpoSZ.mjs";
-import { i as readCodexConversationBindingData, n as createCodexCliNodeConversationBindingData, o as resolveCodexDefaultWorkspaceDir, r as createCodexConversationBindingData } from "./conversation-binding-data-UgLuTSQT.mjs";
+import { i as readCodexConversationBindingData, n as createCodexCliNodeConversationBindingData, o as resolveCodexDefaultWorkspaceDir, r as createCodexConversationBindingData } from "./conversation-binding-data-GRGSgAro.mjs";
 import { r as CodexAppServerRpcError } from "./rpc-error-C98SHchT.mjs";
 import { t as CODEX_CONTROL_METHODS } from "./capabilities-DbOzOglY.mjs";
-import { n as filterCodexMarketplacePlugins, r as parseCodexPluginMarketplaceId, t as discoverCodexMarketplacePlugins } from "./plugin-marketplace-discovery-BblHM3DU.mjs";
-import { o as formatCodexCliSessions } from "./node-cli-sessions-CzKg2nGq.mjs";
+import { n as filterCodexMarketplacePlugins, r as parseCodexPluginMarketplaceId, t as discoverCodexMarketplacePlugins } from "./plugin-marketplace-discovery-BNyI1zd_.mjs";
+import { o as formatCodexCliSessions } from "./node-cli-sessions-BxVYZNuY.mjs";
 import { a as defaultCodexAppInventoryCache, r as buildCodexPluginAppCacheKey } from "./plugin-app-cache-key-Bg9DbDI6.mjs";
-import { i as resolveCodexBindingAppServerConnection } from "./binding-connection-B7HAAZSI.mjs";
-import { a as withCodexAppServerJsonClient } from "./request-Bo0kKABI.mjs";
-import { n as findCodexMarketplacePluginSummary, o as pluginReadParams, r as isOpenAiCuratedMarketplaceName, u as CODEX_PLUGINS_MARKETPLACE_NAME } from "./plugin-inventory-CYgdo14P.mjs";
-import "./config-C1YVVLEA.mjs";
-import { n as resolveCodexAppServerRuntimeOptions } from "./config-runtime-DWzK-k0n.mjs";
+import { i as resolveCodexBindingAppServerConnection } from "./binding-connection-X1ZeEDz8.mjs";
+import { a as withCodexAppServerJsonClient } from "./request-DhbisYCc.mjs";
+import { n as findCodexMarketplacePluginSummary, o as pluginReadParams, r as isOpenAiCuratedMarketplaceName, u as CODEX_PLUGINS_MARKETPLACE_NAME } from "./plugin-inventory-kLR7G02h.mjs";
+import "./config-G4IGX6bK.mjs";
+import { n as resolveCodexAppServerRuntimeOptions } from "./config-runtime-B8agjie6.mjs";
 import { a as resolveCodexAppServerAuthProfileStore, i as resolveCodexAppServerAuthProfileIdForAgent, n as normalizeCodexAppServerBindingModelProvider } from "./auth-profile-CgHQ8Vot.mjs";
-import { F as consumeCodexAppServerLiveThread, R as hasCodexAppServerLiveThread, c as getLeasedSharedCodexAppServerClient, h as releaseLeasedSharedCodexAppServerClient, tt as resolveCodexAppServerAuthAccountCacheKey } from "./shared-client-BCx1wbyA.mjs";
-import { a as isCodexAppServerIndeterminateRequestCancellationError, h as assertCodexThreadResumeResponse, p as assertCodexThreadAcceptsDirectInput, s as isCodexAppServerPrewriteRequestCancellationError } from "./client-D93nbdB8.mjs";
-import { o as closeCodexStartupClientBestEffort } from "./attempt-client-cleanup-zNuNTKVr.mjs";
-import { n as fingerprintCodexAppServerAuthBinding } from "./auth-binding-BaxlhaNx.mjs";
-import { n as listAllCodexAppServerModels } from "./models-BHpbAuz8.mjs";
-import { n as refreshCodexAppRuntimeState, r as refreshCodexPluginRuntimeState } from "./plugin-activation-D7WkJMvU.mjs";
-import { i as resolveCodexSessionBinding, n as createCodexSessionGenerationSupersededError } from "./session-binding-JEHNMPsr.mjs";
-import { a as rollbackCodexAppServerBindingSubscription, c as withExclusiveCodexAppServerThread, i as retireCodexConversationThreadBinding, n as releaseCodexAppServerBindingSubscription, r as retainCodexAppServerBindingSubscription, t as isSameCodexAppServerThreadOwner } from "./thread-ownership-BoUd0i6L.mjs";
-import { n as resolveCodexNativeSandboxBlock, t as resolveCodexNativeExecutionBlock } from "./sandbox-guard-DIImwCy1.mjs";
-import { i as assertCodexSupervisionThreadLineage } from "./thread-policy-B3wBRNph.mjs";
+import { F as consumeCodexAppServerLiveThread, R as hasCodexAppServerLiveThread, c as getLeasedSharedCodexAppServerClient, h as releaseLeasedSharedCodexAppServerClient, tt as resolveCodexAppServerAuthAccountCacheKey } from "./shared-client-wb1JBldZ.mjs";
+import { a as isCodexAppServerIndeterminateRequestCancellationError, h as assertCodexThreadResumeResponse, p as assertCodexThreadAcceptsDirectInput, s as isCodexAppServerPrewriteRequestCancellationError } from "./client-BpSxNz4F.mjs";
+import { o as closeCodexStartupClientBestEffort } from "./attempt-client-cleanup-TScCVTsk.mjs";
+import { n as fingerprintCodexAppServerAuthBinding } from "./auth-binding-BFTkrP_b.mjs";
+import { n as listAllCodexAppServerModels } from "./models-GBLXb27n.mjs";
+import { n as refreshCodexAppRuntimeState, r as refreshCodexPluginRuntimeState } from "./plugin-activation-CsW09DWl.mjs";
+import { i as resolveCodexSessionBinding, n as createCodexSessionGenerationSupersededError } from "./session-binding-BDnNz-Co.mjs";
+import { a as rollbackCodexAppServerBindingSubscription, c as withExclusiveCodexAppServerThread, i as retireCodexConversationThreadBinding, n as releaseCodexAppServerBindingSubscription, r as retainCodexAppServerBindingSubscription, t as isSameCodexAppServerThreadOwner } from "./thread-ownership-CTUs8Eyu.mjs";
+import { n as resolveCodexNativeSandboxBlock, t as resolveCodexNativeExecutionBlock } from "./sandbox-guard-Cf9XMRrg.mjs";
+import { i as assertCodexSupervisionThreadLineage } from "./thread-policy-BMRvlOi-.mjs";
 import { t as defaultCodexPluginMetadataCache } from "./plugin-metadata-cache-Bi8TAPwX.mjs";
-import { n as installCodexComputerUse, r as readCodexComputerUseStatus } from "./computer-use-DL2v3Kxq.mjs";
-import { a as requestOptions, i as readCodexStatusProbes, o as safeCodexControlRequest, r as prepareCodexControlSessionAuth, t as codexControlRequest } from "./command-rpc-HIvsy3wS.mjs";
-import { a as readCodexConversationActiveTurn, c as setCodexConversationModel, d as stopCodexConversationTurn, i as parseCodexPermissionsModeArg, l as setCodexConversationPermissions, n as formatPermissionsMode, r as parseCodexFastModeArg, s as setCodexConversationFastMode, u as steerCodexConversationTurn } from "./conversation-control-GXM3unE4.mjs";
+import { n as installCodexComputerUse, r as readCodexComputerUseStatus } from "./computer-use-BgGC32hr.mjs";
+import { a as requestOptions, i as readCodexStatusProbes, o as safeCodexControlRequest, r as prepareCodexControlSessionAuth, t as codexControlRequest } from "./command-rpc-DpmvEmhc.mjs";
+import { a as readCodexConversationActiveTurn, c as setCodexConversationModel, d as stopCodexConversationTurn, i as parseCodexPermissionsModeArg, l as setCodexConversationPermissions, n as formatPermissionsMode, r as parseCodexFastModeArg, s as setCodexConversationFastMode, u as steerCodexConversationTurn } from "./conversation-control--OHH2dHA.mjs";
 import { normalizeOptionalString, normalizeUniqueStringEntries } from "openclaw/plugin-sdk/string-coerce-runtime";
 import crypto from "node:crypto";
 import { isDeepStrictEqual } from "node:util";

package/dist/.setup/{command-rpc-HIvsy3wS.mjs → command-rpc-DpmvEmhc.mjs}

@@ -1,18 +1,18 @@
 import { i as isJsonObject } from "./protocol-CANUwXJ3.mjs";
 import { o as isCodexAppServerOverloadError, r as CodexAppServerRpcError } from "./rpc-error-C98SHchT.mjs";
 import { n as describeControlFailure, t as CODEX_CONTROL_METHODS } from "./capabilities-DbOzOglY.mjs";
-import { a as withCodexAppServerJsonClient, r as requestCodexAppServerJson } from "./request-Bo0kKABI.mjs";
-import "./config-C1YVVLEA.mjs";
-import { n as resolveCodexAppServerRuntimeOptions, r as resolveCodexSupervisionAppServerRuntimeOptions } from "./config-runtime-DWzK-k0n.mjs";
+import { a as withCodexAppServerJsonClient, r as requestCodexAppServerJson } from "./request-DhbisYCc.mjs";
+import "./config-G4IGX6bK.mjs";
+import { n as resolveCodexAppServerRuntimeOptions, r as resolveCodexSupervisionAppServerRuntimeOptions } from "./config-runtime-B8agjie6.mjs";
 import { a as resolveCodexAppServerAuthProfileStore, r as resolveCodexAppServerAuthProfileId } from "./auth-profile-CgHQ8Vot.mjs";
-import { nt as resolveCodexAppServerPreparedAuthHandoff } from "./shared-client-BCx1wbyA.mjs";
-import { a as isCodexAppServerIndeterminateRequestCancellationError, o as isCodexAppServerIndeterminateTransportError } from "./client-D93nbdB8.mjs";
-import { o as closeCodexStartupClientBestEffort } from "./attempt-client-cleanup-zNuNTKVr.mjs";
-import { r as prepareCodexAppServerAuthBinding } from "./auth-binding-BaxlhaNx.mjs";
-import { r as listCodexAppServerModels } from "./models-BHpbAuz8.mjs";
-import { n as createCodexSessionGenerationSupersededError } from "./session-binding-JEHNMPsr.mjs";
-import { t as resumeCodexAppServerThread } from "./thread-resume-D-3bsr1j.mjs";
-import { t as __exportAll } from "./session-binding-sidecars-DD-enC8w.mjs";
+import { nt as resolveCodexAppServerPreparedAuthHandoff } from "./shared-client-wb1JBldZ.mjs";
+import { a as isCodexAppServerIndeterminateRequestCancellationError, o as isCodexAppServerIndeterminateTransportError } from "./client-BpSxNz4F.mjs";
+import { o as closeCodexStartupClientBestEffort } from "./attempt-client-cleanup-TScCVTsk.mjs";
+import { r as prepareCodexAppServerAuthBinding } from "./auth-binding-BFTkrP_b.mjs";
+import { r as listCodexAppServerModels } from "./models-GBLXb27n.mjs";
+import { n as createCodexSessionGenerationSupersededError } from "./session-binding-BDnNz-Co.mjs";
+import { t as resumeCodexAppServerThread } from "./thread-resume-CD48Vab8.mjs";
+import { t as __exportAll } from "./session-binding-sidecars-DijNZb31.mjs";
 import { resolveAgentDir, resolveSessionAgentIdsStrict } from "openclaw/plugin-sdk/agent-scope-runtime";
 import { resolveAgentWorkspaceDir } from "openclaw/plugin-sdk/agent-runtime";
 import { prepareAgentRuntimeAuth } from "openclaw/plugin-sdk/agent-harness-runtime";

package/dist/.setup/{compact-ClZ7Ar7L.mjs → compact-DpCHUqU5.mjs}

@@ -1,23 +1,23 @@
 import { n as readCodexRuntimeModelId } from "./model-runtime-BdqzOMkU.mjs";
 import { i as isJsonObject } from "./protocol-CANUwXJ3.mjs";
-import { m as sessionBindingIdentity } from "./session-binding-record-DU_0biMD.mjs";
-import { E as waitForCodexAppServerClientExit, S as retainSharedCodexAppServerClientByInstanceId } from "./auth-cache-key-f8ODJ_OX.mjs";
+import { m as sessionBindingIdentity } from "./session-binding-record-C2kDBZhx.mjs";
+import { E as waitForCodexAppServerClientExit, S as retainSharedCodexAppServerClientByInstanceId } from "./auth-cache-key-DvDLHVJe.mjs";
 import { t as CODEX_APP_SERVER_BINDING_GUARDED_REQUEST_TIMEOUT_MS } from "./session-binding-meta-Lkm5Lpf4.mjs";
 import { i as CodexAppServerScopedRequestRejectedError, r as CodexAppServerRpcError } from "./rpc-error-C98SHchT.mjs";
-import { i as resolveCodexBindingAppServerConnection } from "./binding-connection-B7HAAZSI.mjs";
-import { F as consumeCodexAppServerLiveThread, J as revertCodexAppServerLiveThreadInstructions, M as getCodexInferenceThreadQualification, W as protectCodexAppServerLiveThread, _ as retainSharedCodexAppServerClientIfCurrent, q as retainCodexAppServerLiveThread, s as createIsolatedCodexAppServerClient } from "./shared-client-BCx1wbyA.mjs";
+import { i as resolveCodexBindingAppServerConnection } from "./binding-connection-X1ZeEDz8.mjs";
+import { F as consumeCodexAppServerLiveThread, J as revertCodexAppServerLiveThreadInstructions, M as getCodexInferenceThreadQualification, W as protectCodexAppServerLiveThread, _ as retainSharedCodexAppServerClientIfCurrent, q as retainCodexAppServerLiveThread, s as createIsolatedCodexAppServerClient } from "./shared-client-wb1JBldZ.mjs";
 import "./responses-oauth-twnuTaAa.mjs";
-import { a as isCodexAppServerIndeterminateRequestCancellationError, s as isCodexAppServerPrewriteRequestCancellationError } from "./client-D93nbdB8.mjs";
-import { c as readCodexNotificationTurnId, s as readCodexNotificationThreadId } from "./turn-router-DBVMToGo.mjs";
-import { c as isCodexNoActiveTurnInterruptError, f as unsubscribeCodexThreadBestEffort, o as closeCodexStartupClientBestEffort, r as CodexAppServerUnsafeSubscriptionError } from "./attempt-client-cleanup-zNuNTKVr.mjs";
+import { a as isCodexAppServerIndeterminateRequestCancellationError, s as isCodexAppServerPrewriteRequestCancellationError } from "./client-BpSxNz4F.mjs";
+import { c as readCodexNotificationTurnId, s as readCodexNotificationThreadId } from "./turn-router-DdlzuFdm.mjs";
+import { c as isCodexNoActiveTurnInterruptError, f as unsubscribeCodexThreadBestEffort, o as closeCodexStartupClientBestEffort, r as CodexAppServerUnsafeSubscriptionError } from "./attempt-client-cleanup-TScCVTsk.mjs";
 import { n as readCodexThreadContextSnapshot, s as readCodexNotificationItem } from "./event-projector-usage-BpKfdoTm.mjs";
-import { i as resolveCodexSessionBinding } from "./session-binding-JEHNMPsr.mjs";
-import { s as withCodexAppServerThreadMutationHold, t as isSameCodexAppServerThreadOwner } from "./thread-ownership-BoUd0i6L.mjs";
+import { i as resolveCodexSessionBinding } from "./session-binding-BDnNz-Co.mjs";
+import { s as withCodexAppServerThreadMutationHold, t as isSameCodexAppServerThreadOwner } from "./thread-ownership-CTUs8Eyu.mjs";
 import { t as persistCodexContextCompactionActivity } from "./context-compaction-activity-CMla5FPJ.mjs";
-import { t as codexNativeSubagentMonitorRuntime } from "./native-subagent-monitor-DOLEIf9r.mjs";
-import { t as resolveCodexNativeExecutionBlock } from "./sandbox-guard-DIImwCy1.mjs";
-import { i as assertCodexSupervisionThreadLineage } from "./thread-policy-B3wBRNph.mjs";
-import { t as resumeCodexAppServerThread } from "./thread-resume-D-3bsr1j.mjs";
+import { t as codexNativeSubagentMonitorRuntime } from "./native-subagent-monitor-gqu3TQOv.mjs";
+import { t as resolveCodexNativeExecutionBlock } from "./sandbox-guard-Cf9XMRrg.mjs";
+import { i as assertCodexSupervisionThreadLineage } from "./thread-policy-BMRvlOi-.mjs";
+import { t as resumeCodexAppServerThread } from "./thread-resume-CD48Vab8.mjs";
 import { asOptionalRecord } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { coerceErrorMessage } from "openclaw/plugin-sdk/error-runtime";
 import { isIncognitoSessionKey } from "openclaw/plugin-sdk/session-key-runtime";

package/dist/.setup/{computer-use-DL2v3Kxq.mjs → computer-use-BgGC32hr.mjs}

@@ -1,13 +1,13 @@
 import { t as resolveCodexAppServerHomeDir } from "./auth-start-options-BPIPeEX8.mjs";
-import { o as resolveCodexComputerUseConfig } from "./config-options-DDzeNQ8m.mjs";
-import { d as resolveMacOSDesktopCodexBundledMarketplaceCandidates, t as isManagedCodexDesktopCommand } from "./managed-binary-BtIjV7yN.mjs";
+import { o as resolveCodexComputerUseConfig } from "./config-options-nvYwVDyy.mjs";
+import { d as resolveMacOSDesktopCodexBundledMarketplaceCandidates, t as isManagedCodexDesktopCommand } from "./managed-binary-DwC9wxch.mjs";
 import { n as describeControlFailure } from "./capabilities-DbOzOglY.mjs";
-import { n as requestCodexAppServerClientJson } from "./request-Bo0kKABI.mjs";
-import "./config-C1YVVLEA.mjs";
-import { n as resolveCodexAppServerRuntimeOptions } from "./config-runtime-DWzK-k0n.mjs";
-import { O as acquireCodexNativeConfigFence, at as hasLegacyCodexComputerUseMcpPolicy, b as withLeasedCodexAppServerClientStartSelectionRetry, c as getLeasedSharedCodexAppServerClient, ct as ensureCodexComputerUseSharedPluginCache, d as readCodexAppServerClientDesktopGeneration, et as reconcileCodexComputerUseStartArtifacts, g as resolveCodexNativeConfigFenceKey, h as releaseLeasedSharedCodexAppServerClient, it as resolveClientManagedBundledMarketplacePath, lt as assertNotSymlink, ot as isLegacyCodexComputerUsePluginDisabled, p as readCodexAppServerClientProcessIdentity, rt as resolveBundledComputerUseMarketplacePath, st as resolveManagedCodexComputerUseConfig, t as assertCodexAppServerClientStartSelectionCurrent, u as isCodexAppServerStartSelectionChangedError, y as waitForCodexAppServerClientDesktopGenerationDrain } from "./shared-client-BCx1wbyA.mjs";
-import { a as isCodexAppServerIndeterminateRequestCancellationError, i as isCodexAppServerConnectionClosedError, o as isCodexAppServerIndeterminateTransportError } from "./client-D93nbdB8.mjs";
-import { l as retireUnsafeCodexTurnClientBestEffort, r as CodexAppServerUnsafeSubscriptionError } from "./attempt-client-cleanup-zNuNTKVr.mjs";
+import { n as requestCodexAppServerClientJson } from "./request-DhbisYCc.mjs";
+import "./config-G4IGX6bK.mjs";
+import { n as resolveCodexAppServerRuntimeOptions } from "./config-runtime-B8agjie6.mjs";
+import { O as acquireCodexNativeConfigFence, at as hasLegacyCodexComputerUseMcpPolicy, b as withLeasedCodexAppServerClientStartSelectionRetry, c as getLeasedSharedCodexAppServerClient, ct as ensureCodexComputerUseSharedPluginCache, d as readCodexAppServerClientDesktopGeneration, et as reconcileCodexComputerUseStartArtifacts, g as resolveCodexNativeConfigFenceKey, h as releaseLeasedSharedCodexAppServerClient, it as resolveClientManagedBundledMarketplacePath, lt as assertNotSymlink, ot as isLegacyCodexComputerUsePluginDisabled, p as readCodexAppServerClientProcessIdentity, rt as resolveBundledComputerUseMarketplacePath, st as resolveManagedCodexComputerUseConfig, t as assertCodexAppServerClientStartSelectionCurrent, u as isCodexAppServerStartSelectionChangedError, y as waitForCodexAppServerClientDesktopGenerationDrain } from "./shared-client-wb1JBldZ.mjs";
+import { a as isCodexAppServerIndeterminateRequestCancellationError, i as isCodexAppServerConnectionClosedError, o as isCodexAppServerIndeterminateTransportError } from "./client-BpSxNz4F.mjs";
+import { l as retireUnsafeCodexTurnClientBestEffort, r as CodexAppServerUnsafeSubscriptionError } from "./attempt-client-cleanup-TScCVTsk.mjs";
 import path from "node:path";
 import fs from "node:fs/promises";
 import { toErrorObject } from "openclaw/plugin-sdk/error-runtime";

package/dist/.setup/{config-C1YVVLEA.mjs → config-G4IGX6bK.mjs}

@@ -1,10 +1,9 @@
-import "./config-security-clxAZYWX.mjs";
-import { a as readExecAsk, l as readRecord, o as readExecSecurity } from "./config-utils-DN_YT7dE.mjs";
-import "./config-parsing-DsWSCPHO.mjs";
+import "./config-security-D0hAOQRI.mjs";
+import { _ as readExecSecurity, b as readRecord, g as readExecAsk } from "./config-parsing-CVK2Q463.mjs";
 import "./auth-start-options-BPIPeEX8.mjs";
-import { c as canUseCodexModelBackedApprovalsReviewerForModel$1 } from "./config-options-DDzeNQ8m.mjs";
-import { n as resolveCodexAppServerRuntimeOptions } from "./config-runtime-DWzK-k0n.mjs";
-import { t as __exportAll } from "./session-binding-sidecars-DD-enC8w.mjs";
+import { c as canUseCodexModelBackedApprovalsReviewerForModel$1 } from "./config-options-nvYwVDyy.mjs";
+import { n as resolveCodexAppServerRuntimeOptions } from "./config-runtime-B8agjie6.mjs";
+import { t as __exportAll } from "./session-binding-sidecars-DijNZb31.mjs";
 import { resolveAgentConfig } from "openclaw/plugin-sdk/agent-scope-runtime";
 import { execPolicy } from "openclaw/plugin-sdk/agent-harness-runtime";
 import { resolveExecApprovalsFromFile } from "openclaw/plugin-sdk/exec-approvals-runtime";

package/dist/.setup/{config-options-DDzeNQ8m.mjs → config-options-nvYwVDyy.mjs}

@@ -1,7 +1,6 @@
 import { i as isJsonObject } from "./protocol-CANUwXJ3.mjs";
-import { _ as resolveCodexPolicyModeForOpenClawExecMode, a as resolveDefaultCodexAppServerPolicy, b as selectForcedDangerFullAccessSandbox, d as readCodexRequirementsToml, g as resolveApprovalPolicy, h as assertCodexAppServerAllowedForOpenClawExecMode, i as resolveCodexAppServerNetworkProxy, o as resolvePolicyMode, r as inferCodexAppServerConnectionClass, t as assertCodexAppServerConnectionSecurity, u as parseCodexRequirementsPolicy, v as resolveEffectiveOpenClawExecModeForCodexAppServer, x as selectForcedPromptingSandbox, y as resolveSandbox } from "./config-security-clxAZYWX.mjs";
-import { c as readNumberEnv, i as normalizeHeaders, l as readRecord, n as hashSecretForKey, s as readNonEmptyString, u as resolveArgs } from "./config-utils-DN_YT7dE.mjs";
-import { a as DEFAULT_CODEX_COMPUTER_USE_PLUGIN_NAME, d as readCodexPluginConfig, n as DEFAULT_CODEX_COMPUTER_USE_LIVE_TEST_TIMEOUT_MS, o as DEFAULT_CODEX_COMPUTER_USE_TOOL_CALL_TIMEOUT_MS, r as DEFAULT_CODEX_COMPUTER_USE_MARKETPLACE_DISCOVERY_TIMEOUT_MS, s as assertCodexAppServerCommandHasNoInlineArgs } from "./config-parsing-DsWSCPHO.mjs";
+import { _ as resolveCodexPolicyModeForOpenClawExecMode, a as resolveDefaultCodexAppServerPolicy, b as selectForcedDangerFullAccessSandbox, d as readCodexRequirementsToml, g as resolveApprovalPolicy, h as assertCodexAppServerAllowedForOpenClawExecMode, i as resolveCodexAppServerNetworkProxy, o as resolvePolicyMode, r as inferCodexAppServerConnectionClass, t as assertCodexAppServerConnectionSecurity, u as parseCodexRequirementsPolicy, v as resolveEffectiveOpenClawExecModeForCodexAppServer, x as selectForcedPromptingSandbox, y as resolveSandbox } from "./config-security-D0hAOQRI.mjs";
+import { a as DEFAULT_CODEX_COMPUTER_USE_PLUGIN_NAME, b as readRecord, d as readCodexPluginConfig, h as normalizeHeaders, n as DEFAULT_CODEX_COMPUTER_USE_LIVE_TEST_TIMEOUT_MS, o as DEFAULT_CODEX_COMPUTER_USE_TOOL_CALL_TIMEOUT_MS, p as hashSecretForKey, r as DEFAULT_CODEX_COMPUTER_USE_MARKETPLACE_DISCOVERY_TIMEOUT_MS, s as assertCodexAppServerCommandHasNoInlineArgs, v as readNonEmptyString, x as resolveArgs, y as readNumberEnv } from "./config-parsing-CVK2Q463.mjs";
 import { i as readCodexAppServerConfigOptions } from "./launch-args-DbFCehO7.mjs";
 import { r as resolveCodexAppServerUserHomeDir, t as resolveCodexAppServerHomeDir } from "./auth-start-options-BPIPeEX8.mjs";
 import { normalizeTrimmedStringList, parseBooleanValue } from "openclaw/plugin-sdk/string-coerce-runtime";

package/dist/.setup/{config-parsing-DsWSCPHO.mjs → config-parsing-CVK2Q463.mjs}

@@ -1,10 +1,48 @@
-import { t as CODEX_PLUGIN_MARKETPLACE_NAME_PATTERN } from "./config-contracts.shared-D85SGEuq.mjs";
-import { t as normalizeCodexServiceTier } from "./service-tier-normalization-BPgw2Wdt.mjs";
-import "./config-utils-DN_YT7dE.mjs";
-import { asNullableRecord } from "openclaw/plugin-sdk/string-coerce-runtime";
+import { n as CODEX_PLUGIN_MARKETPLACE_NAME_PATTERN, t as normalizeCodexServiceTier } from "./service-tier-normalization-C2OVdF6E.mjs";
+import { asNullableRecord, asOptionalRecord as readRecord, normalizeOptionalString as readNonEmptyString, normalizeTrimmedStringList } from "openclaw/plugin-sdk/string-coerce-runtime";
+import { createHmac, randomBytes } from "node:crypto";
 import { z } from "zod";
-import { buildSecretInputSchema } from "openclaw/plugin-sdk/secret-input";
+import { buildSecretInputSchema, normalizeResolvedSecretInputString } from "openclaw/plugin-sdk/secret-input";
 import { detectWindowsSpawnCommandInlineArgs } from "openclaw/plugin-sdk/windows-spawn";
+import { resolveGlobalSingleton } from "openclaw/plugin-sdk/global-singleton";
+import { splitCommandArgs } from "openclaw/plugin-sdk/process-runtime";
+//#region extensions/codex/src/app-server/config-utils.ts
+const START_OPTIONS_KEY_SECRET = resolveGlobalSingleton(Symbol.for("openclaw.codexAppServerStartOptionsKeySecret"), () => randomBytes(32));
+const PLAIN_DECIMAL_NUMBER_RE = /^[+-]?(?:(?:\d+\.?\d*)|(?:\.\d+))$/;
+function isCodexFastServiceTier(value) {
+	return normalizeCodexServiceTier(value) === "priority";
+}
+function normalizeHeaders(value) {
+	return Object.fromEntries(Object.entries(value ?? {}).flatMap(([key, child]) => {
+		const name = key.trim();
+		const header = normalizeResolvedSecretInputString({
+			value: child,
+			path: `plugins.entries.codex.config.appServer.headers.${key}`
+		});
+		return name && header ? [[name, header]] : [];
+	}));
+}
+function readExecSecurity(value) {
+	return value === "deny" || value === "allowlist" || value === "full" ? value : void 0;
+}
+function readExecAsk(value) {
+	return value === "off" || value === "on-miss" || value === "always" ? value : void 0;
+}
+function readNumberEnv(value) {
+	const trimmed = value?.trim();
+	if (!trimmed || !PLAIN_DECIMAL_NUMBER_RE.test(trimmed)) return;
+	const parsed = Number(trimmed);
+	return Number.isFinite(parsed) ? parsed : void 0;
+}
+function resolveArgs(configArgs, envArgs) {
+	if (Array.isArray(configArgs)) return normalizeTrimmedStringList(configArgs);
+	return splitCommandArgs(configArgs ?? envArgs ?? "", { allowUnclosedQuotes: true });
+}
+function hashSecretForKey(value, label) {
+	if (!value) return null;
+	return createHmac("sha256", START_OPTIONS_KEY_SECRET).update(label).update("\0").update(value).digest("hex");
+}
+//#endregion
 //#region extensions/codex/src/app-server/session-discovery-config.ts
 const codexSessionCatalogHomeSchema = z.union([z.string().trim().min(1), z.object({
 	path: z.string().trim().min(1),
@@ -228,4 +266,4 @@ function resolveCodexPluginDestructivePolicy(policy) {
 	};
 }
 //#endregion
-export { DEFAULT_CODEX_COMPUTER_USE_PLUGIN_NAME as a, isCodexPairedNodeRemoteExecPlacementSandbox as c, readCodexPluginConfig as d, resolveCodexPluginsPolicy as f, DEFAULT_CODEX_COMPUTER_USE_MCP_SERVER_NAME as i, isCodexRemoteExecPlacementSandbox as l, DEFAULT_CODEX_COMPUTER_USE_LIVE_TEST_TIMEOUT_MS as n, DEFAULT_CODEX_COMPUTER_USE_TOOL_CALL_TIMEOUT_MS as o, DEFAULT_CODEX_COMPUTER_USE_MARKETPLACE_DISCOVERY_TIMEOUT_MS as r, assertCodexAppServerCommandHasNoInlineArgs as s, DEFAULT_CODEX_APP_SERVER_NETWORK_PROXY_PROFILE_PREFIX as t, isCodexSandboxExecServerEnabled as u };
+export { readExecSecurity as _, DEFAULT_CODEX_COMPUTER_USE_PLUGIN_NAME as a, readRecord as b, isCodexPairedNodeRemoteExecPlacementSandbox as c, readCodexPluginConfig as d, resolveCodexPluginsPolicy as f, readExecAsk as g, normalizeHeaders as h, DEFAULT_CODEX_COMPUTER_USE_MCP_SERVER_NAME as i, isCodexRemoteExecPlacementSandbox as l, isCodexFastServiceTier as m, DEFAULT_CODEX_COMPUTER_USE_LIVE_TEST_TIMEOUT_MS as n, DEFAULT_CODEX_COMPUTER_USE_TOOL_CALL_TIMEOUT_MS as o, hashSecretForKey as p, DEFAULT_CODEX_COMPUTER_USE_MARKETPLACE_DISCOVERY_TIMEOUT_MS as r, assertCodexAppServerCommandHasNoInlineArgs as s, DEFAULT_CODEX_APP_SERVER_NETWORK_PROXY_PROFILE_PREFIX as t, isCodexSandboxExecServerEnabled as u, readNonEmptyString as v, resolveArgs as x, readNumberEnv as y };

package/dist/.setup/{config-runtime-DWzK-k0n.mjs → config-runtime-B8agjie6.mjs}

@@ -1,5 +1,5 @@
-import { r as createCodexAppServerConfig } from "./config-options-DDzeNQ8m.mjs";
-import { t as __exportAll } from "./session-binding-sidecars-DD-enC8w.mjs";
+import { r as createCodexAppServerConfig } from "./config-options-nvYwVDyy.mjs";
+import { t as __exportAll } from "./session-binding-sidecars-DijNZb31.mjs";
 import { resolveProviderIdForAuth } from "openclaw/plugin-sdk/provider-auth-aliases";
 //#region extensions/codex/src/app-server/config-runtime.ts
 var config_runtime_exports = /* @__PURE__ */ __exportAll({

package/dist/.setup/{config-security-clxAZYWX.mjs → config-security-D0hAOQRI.mjs}

@@ -1,5 +1,4 @@
-import { l as readRecord, s as readNonEmptyString } from "./config-utils-DN_YT7dE.mjs";
-import "./config-parsing-DsWSCPHO.mjs";
+import { b as readRecord, v as readNonEmptyString } from "./config-parsing-CVK2Q463.mjs";
 import { createHash } from "node:crypto";
 import { AgentHarnessPreflightError } from "openclaw/plugin-sdk/agent-harness-registration";
 import { parse } from "smol-toml";

package/dist/.setup/{conversation-binding-BieJZRRV.mjs → conversation-binding-BCoWi2Kn.mjs}

@@ -1,27 +1,27 @@
 import { i as isJsonObject } from "./protocol-CANUwXJ3.mjs";
-import { m as sessionBindingIdentity, n as assertCodexBindingMayBeReplaced } from "./session-binding-record-DU_0biMD.mjs";
-import { d as readCodexRequirementsToml } from "./config-security-clxAZYWX.mjs";
-import { d as readCodexPluginConfig } from "./config-parsing-DsWSCPHO.mjs";
-import { d as readCodexEffectiveConfig, n as codexSandboxPolicyForTurn } from "./config-options-DDzeNQ8m.mjs";
-import { S as retainSharedCodexAppServerClientByInstanceId } from "./auth-cache-key-f8ODJ_OX.mjs";
-import { o as resolveCodexDefaultWorkspaceDir } from "./conversation-binding-data-UgLuTSQT.mjs";
+import { m as sessionBindingIdentity, n as assertCodexBindingMayBeReplaced } from "./session-binding-record-C2kDBZhx.mjs";
+import { d as readCodexRequirementsToml } from "./config-security-D0hAOQRI.mjs";
+import { d as readCodexPluginConfig } from "./config-parsing-CVK2Q463.mjs";
+import { d as readCodexEffectiveConfig, n as codexSandboxPolicyForTurn } from "./config-options-nvYwVDyy.mjs";
+import { S as retainSharedCodexAppServerClientByInstanceId } from "./auth-cache-key-DvDLHVJe.mjs";
+import { o as resolveCodexDefaultWorkspaceDir } from "./conversation-binding-data-GRGSgAro.mjs";
 import { o as isCodexAppServerOverloadError } from "./rpc-error-C98SHchT.mjs";
 import { n as projectBoundedCodexVisibleSessionHistory } from "./transcript-history-projection-DfKcoZCB.mjs";
-import { n as canUseCodexModelBackedApprovalsReviewerForModel, r as resolveOpenClawExecPolicyForCodexAppServer } from "./config-C1YVVLEA.mjs";
-import { n as resolveCodexAppServerRuntimeOptions } from "./config-runtime-DWzK-k0n.mjs";
+import { n as canUseCodexModelBackedApprovalsReviewerForModel, r as resolveOpenClawExecPolicyForCodexAppServer } from "./config-G4IGX6bK.mjs";
+import { n as resolveCodexAppServerRuntimeOptions } from "./config-runtime-B8agjie6.mjs";
 import { n as normalizeCodexAppServerBindingModelProvider, t as isCodexAppServerNativeAuthProfile } from "./auth-profile-CgHQ8Vot.mjs";
-import { B as isCodexAppServerClientRuntimeLive, F as consumeCodexAppServerLiveThread, K as releaseCodexAppServerLiveThread, R as hasCodexAppServerLiveThread, V as isCodexAppServerLiveThreadClaimed, b as withLeasedCodexAppServerClientStartSelectionRetry, c as getLeasedSharedCodexAppServerClient, m as releaseCodexAppServerClientLease } from "./shared-client-BCx1wbyA.mjs";
-import { a as isCodexAppServerIndeterminateRequestCancellationError, g as assertCodexThreadStartResponse, p as assertCodexThreadAcceptsDirectInput, u as CodexThreadDirectInputError } from "./client-D93nbdB8.mjs";
-import { a as isCodexNotificationForTurn, n as getCodexAppServerTurnRouter } from "./turn-router-DBVMToGo.mjs";
-import { f as unsubscribeCodexThreadBestEffort, l as retireUnsafeCodexTurnClientBestEffort, o as closeCodexStartupClientBestEffort, r as CodexAppServerUnsafeSubscriptionError, s as interruptCodexTurnAndWaitBestEffort } from "./attempt-client-cleanup-zNuNTKVr.mjs";
-import { d as mergeCodexThreadConfigs, s as buildDisabledAppsConfigPatch, t as buildCodexProjectDocThreadConfig } from "./project-doc-thread-config-BVcvnps8.mjs";
-import "./session-binding-JEHNMPsr.mjs";
+import { B as isCodexAppServerClientRuntimeLive, F as consumeCodexAppServerLiveThread, K as releaseCodexAppServerLiveThread, R as hasCodexAppServerLiveThread, V as isCodexAppServerLiveThreadClaimed, b as withLeasedCodexAppServerClientStartSelectionRetry, c as getLeasedSharedCodexAppServerClient, m as releaseCodexAppServerClientLease } from "./shared-client-wb1JBldZ.mjs";
+import { a as isCodexAppServerIndeterminateRequestCancellationError, g as assertCodexThreadStartResponse, p as assertCodexThreadAcceptsDirectInput, u as CodexThreadDirectInputError } from "./client-BpSxNz4F.mjs";
+import { a as isCodexNotificationForTurn, n as getCodexAppServerTurnRouter } from "./turn-router-DdlzuFdm.mjs";
+import { f as unsubscribeCodexThreadBestEffort, l as retireUnsafeCodexTurnClientBestEffort, o as closeCodexStartupClientBestEffort, r as CodexAppServerUnsafeSubscriptionError, s as interruptCodexTurnAndWaitBestEffort } from "./attempt-client-cleanup-TScCVTsk.mjs";
+import { d as mergeCodexThreadConfigs, s as buildDisabledAppsConfigPatch, t as buildCodexProjectDocThreadConfig } from "./project-doc-thread-config-B2ZD23A_.mjs";
+import "./session-binding-BDnNz-Co.mjs";
 import { r as resolveCodexAppServerRequestModelSelection, t as CODEX_NATIVE_PERSONALITY_NONE } from "./thread-model-selection-DcVebr8N.mjs";
-import { a as rollbackCodexAppServerBindingSubscription, c as withExclusiveCodexAppServerThread, n as releaseCodexAppServerBindingSubscription, r as retainCodexAppServerBindingSubscription, t as isSameCodexAppServerThreadOwner } from "./thread-ownership-BoUd0i6L.mjs";
-import { t as resumeCodexAppServerThread } from "./thread-resume-D-3bsr1j.mjs";
-import { i as resolveCodexSessionPermissionCwd, n as applyCodexSessionPermissionPolicy, t as CODEX_SESSION_PERMISSION_EXEC_MODES } from "./session-permission-policy-CD2MAWU8.mjs";
-import { t as resolveCodexAppServerForModelProvider } from "./app-server-policy-D_zv8J7V.mjs";
-import { f as trackCodexConversationActiveTurn, o as resolveThreadRequestModelProvider, t as buildCodexConversationAgentLookup } from "./conversation-control-GXM3unE4.mjs";
+import { a as rollbackCodexAppServerBindingSubscription, c as withExclusiveCodexAppServerThread, n as releaseCodexAppServerBindingSubscription, r as retainCodexAppServerBindingSubscription, t as isSameCodexAppServerThreadOwner } from "./thread-ownership-CTUs8Eyu.mjs";
+import { t as resumeCodexAppServerThread } from "./thread-resume-CD48Vab8.mjs";
+import { i as resolveCodexSessionPermissionCwd, n as applyCodexSessionPermissionPolicy, t as CODEX_SESSION_PERMISSION_EXEC_MODES } from "./session-permission-policy-BYI6mp5u.mjs";
+import { t as resolveCodexAppServerForModelProvider } from "./app-server-policy-XTIa6h5k.mjs";
+import { f as trackCodexConversationActiveTurn, o as resolveThreadRequestModelProvider, t as buildCodexConversationAgentLookup } from "./conversation-control--OHH2dHA.mjs";
 import { asOptionalRecord, normalizeOptionalString, readNonEmptyStringPreservingWhitespace } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { resolveSessionAgentIdsStrict } from "openclaw/plugin-sdk/agent-scope-runtime";
 import { resolveTimerTimeoutMs } from "openclaw/plugin-sdk/number-runtime";

package/dist/.setup/{conversation-binding-data-UgLuTSQT.mjs → conversation-binding-data-GRGSgAro.mjs}

@@ -1,4 +1,4 @@
-import { t as __exportAll } from "./session-binding-sidecars-DD-enC8w.mjs";
+import { t as __exportAll } from "./session-binding-sidecars-DijNZb31.mjs";
 import { asOptionalRecord, normalizeOptionalString, readNonBlankString } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { createHash, randomUUID } from "node:crypto";
 import process from "node:process";