@openclaw/codex 2026.10.5-beta.4 → 2026.10.5

package/dist/.setup/{conversation-control-GXM3unE4.mjs → conversation-control--OHH2dHA.mjs}

@@ -1,9 +1,9 @@
-import { r as bindingStoreKey } from "./session-binding-record-DU_0biMD.mjs";
-import { r as isCodexFastServiceTier } from "./config-utils-DN_YT7dE.mjs";
+import { r as bindingStoreKey } from "./session-binding-record-C2kDBZhx.mjs";
+import { m as isCodexFastServiceTier } from "./config-parsing-CVK2Q463.mjs";
 import { o as formatCodexDisplayText } from "./command-formatters-xW9KpoSZ.mjs";
-import "./config-C1YVVLEA.mjs";
+import "./config-G4IGX6bK.mjs";
 import { n as normalizeCodexAppServerBindingModelProvider, t as isCodexAppServerNativeAuthProfile } from "./auth-profile-CgHQ8Vot.mjs";
-import "./session-binding-JEHNMPsr.mjs";
+import "./session-binding-BDnNz-Co.mjs";
 import { a as resolveCodexBindingModelProviderFallback, r as resolveCodexAppServerRequestModelSelection } from "./thread-model-selection-DcVebr8N.mjs";
 import { resolveAgentDir } from "openclaw/plugin-sdk/agent-runtime";
 import { getSessionEntry, patchSessionEntry, resolveStorePath } from "openclaw/plugin-sdk/session-store-runtime";

package/dist/.setup/{cyber-failover-D4dgNfFf.mjs → cyber-failover-B-q6oT01.mjs}

@@ -1,5 +1,5 @@
-import { d as readCodexPluginConfig } from "./config-parsing-DsWSCPHO.mjs";
-import { t as attemptTerminal } from "./attempt-terminal-jO5IMj9K.mjs";
+import { d as readCodexPluginConfig } from "./config-parsing-CVK2Q463.mjs";
+import { t as attemptTerminal } from "./attempt-terminal-sZutF0WY.mjs";
 //#region extensions/codex/src/app-server/cyber-failover.ts
 /**
 * Automatic Daybreak escalation for OpenAI cyber-policy refusals.

package/dist/.setup/{cyber-failover-notice-ljgGGL0s.mjs → cyber-failover-notice-poL3Advd.mjs}

@@ -1,4 +1,4 @@
-import { t as emitCodexAppServerEvent } from "./run-attempt-lifecycle-KN4oh-7O.mjs";
+import { t as emitCodexAppServerEvent } from "./run-attempt-lifecycle-DN-ATDp9.mjs";
 //#region extensions/codex/src/app-server/cyber-failover-notice.ts
 async function emitCodexCyberNotice(params, notice) {
 	await emitCodexAppServerEvent(params, {

package/dist/.setup/{doctor-start-options-JjTAl-q_.mjs → doctor-start-options-DedLaoqI.mjs}

@@ -1,8 +1,8 @@
-import { d as readCodexPluginConfig } from "./config-parsing-DsWSCPHO.mjs";
-import { a as resolveCodexAppServerStartOptionsForAgent } from "./config-options-DDzeNQ8m.mjs";
-import { r as resolveManagedCodexAppServerStartOptions, t as isManagedCodexDesktopCommand } from "./managed-binary-BtIjV7yN.mjs";
-import "./config-C1YVVLEA.mjs";
-import { n as resolveCodexAppServerRuntimeOptions } from "./config-runtime-DWzK-k0n.mjs";
+import { d as readCodexPluginConfig } from "./config-parsing-CVK2Q463.mjs";
+import { a as resolveCodexAppServerStartOptionsForAgent } from "./config-options-nvYwVDyy.mjs";
+import { r as resolveManagedCodexAppServerStartOptions, t as isManagedCodexDesktopCommand } from "./managed-binary-DwC9wxch.mjs";
+import "./config-G4IGX6bK.mjs";
+import { n as resolveCodexAppServerRuntimeOptions } from "./config-runtime-B8agjie6.mjs";
 import { listAgentIds, resolveAgentDir } from "openclaw/plugin-sdk/agent-scope-runtime";
 import { resolveDefaultModelForAgent } from "openclaw/plugin-sdk/agent-runtime";
 import { resolveEffectiveAgentRuntime } from "openclaw/plugin-sdk/command-auth-native";

package/dist/.setup/{dynamic-tool-build-DcaPmBlE.mjs → dynamic-tool-build-CoMf7IKx.mjs}

@@ -1,10 +1,10 @@
 import { CODEX_NATIVE_TOOL_REQUIREMENTS } from "../native-tool-policy.js";
-import { c as isCodexPairedNodeRemoteExecPlacementSandbox, d as readCodexPluginConfig, l as isCodexRemoteExecPlacementSandbox } from "./config-parsing-DsWSCPHO.mjs";
-import "./config-C1YVVLEA.mjs";
+import { c as isCodexPairedNodeRemoteExecPlacementSandbox, d as readCodexPluginConfig, l as isCodexRemoteExecPlacementSandbox } from "./config-parsing-CVK2Q463.mjs";
+import "./config-G4IGX6bK.mjs";
 import { a as isCodexResponsesOAuthRun } from "./responses-oauth-twnuTaAa.mjs";
-import { F as isForcedPrivateQaCodexRuntime, L as isSystemAgentOnlyCodexDynamicToolAllowlist, P as filterCodexDynamicTools, R as normalizeCodexDynamicToolName, h as resolveCodexWebSearchPlan } from "./thread-requests-BgzJwJtS.mjs";
+import { F as isForcedPrivateQaCodexRuntime, L as isSystemAgentOnlyCodexDynamicToolAllowlist, P as filterCodexDynamicTools, R as normalizeCodexDynamicToolName, h as resolveCodexWebSearchPlan } from "./thread-requests-BqPhA4Gs.mjs";
 import { n as resolveCodexNativeExecutionPolicy, r as resolveCodexNodeExecToolOverrides } from "./native-execution-policy-MXEe7PB3.mjs";
-import { _ as createGatewayProcessProjection, b as isCodexDynamicToolExcluded, g as createGatewayExecProjection, v as createNodeExecAliasDynamicTool, x as placeDisabledNativeShellToolsInDirectNamespace, y as createSandboxShellProjection } from "./native-hook-relay-wq7jrNLk.mjs";
+import { _ as createGatewayProcessProjection, b as isCodexDynamicToolExcluded, g as createGatewayExecProjection, v as createNodeExecAliasDynamicTool, x as placeDisabledNativeShellToolsInDirectNamespace, y as createSandboxShellProjection } from "./native-hook-relay-BQ9UkpeG.mjs";
 import path from "node:path";
 import { createStageTimingTracker, formatStageTimings } from "openclaw/plugin-sdk/time-runtime";
 import { resolveAgentDir } from "openclaw/plugin-sdk/agent-runtime";
@@ -350,7 +350,7 @@ async function buildDynamicTools(input) {
 	return exposedTools;
 }
 function shouldEnableCodexAppServerNativeToolSurface(params, sandbox, options = {}) {
-	if (isCodexResponsesOAuthRun(params) || params.requireWorkspaceOnly === true || params.pluginHarnessToolPolicyRestricted === true || isCodexMemoryFlushRun(params) || params.disableTools) return false;
+	if (isCodexResponsesOAuthRun(params) || params.requireWorkspaceOnly === true || params.pluginHarnessToolPolicyRestricted === true || isCodexMemoryFlushRun(params) || params.disableTools || params.oneShotCliRun === true) return false;
 	if (!resolveCodexNativeExecutionPolicyForRun(params, {
 		agentId: options.agentId,
 		runtimeSessionKey: options.runtimeSessionKey,

package/dist/.setup/{dynamic-tools-CnQFnNKH.mjs → dynamic-tools-CKynHtxM.mjs}

@@ -1,21 +1,21 @@
 import { i as isJsonObject, r as flattenCodexDynamicToolFunctions, t as CODEX_OPENCLAW_DIRECT_DYNAMIC_TOOL_NAMESPACE } from "./protocol-CANUwXJ3.mjs";
-import { n as codexSandboxPolicyForTurn } from "./config-options-DDzeNQ8m.mjs";
+import { n as codexSandboxPolicyForTurn } from "./config-options-nvYwVDyy.mjs";
 import { o as formatCodexDisplayText } from "./command-formatters-xW9KpoSZ.mjs";
 import { o as readItem } from "./event-projector-values-CLvG1Hil.mjs";
 import { s as codexAppIdentityKey } from "./plugin-app-cache-key-Bg9DbDI6.mjs";
-import "./config-C1YVVLEA.mjs";
+import "./config-G4IGX6bK.mjs";
 import { r as invalidInlineImageText } from "./session-history-read-BI_2jRED.mjs";
 import { o as neutralizeCodexExplicitMentionSigils } from "./context-engine-projection-ps-yn_ci.mjs";
-import { W as protectCodexAppServerLiveThread, _ as retainSharedCodexAppServerClientIfCurrent } from "./shared-client-BCx1wbyA.mjs";
-import { A as createFailedDynamicToolResponse, j as failedToolResult, k as resolveCodexToolAbortTerminalReason, l as CodexServerRequestResolvedError, w as createCodexElicitationResponse, x as readCodexTurnCompletedNotification } from "./client-D93nbdB8.mjs";
+import { W as protectCodexAppServerLiveThread, _ as retainSharedCodexAppServerClientIfCurrent } from "./shared-client-wb1JBldZ.mjs";
+import { A as createFailedDynamicToolResponse, j as failedToolResult, k as resolveCodexToolAbortTerminalReason, l as CodexServerRequestResolvedError, w as createCodexElicitationResponse, x as readCodexTurnCompletedNotification } from "./client-BpSxNz4F.mjs";
 import { t as codexWebSocketDataToBuffer } from "./websocket-data-XlRvt8Ys.mjs";
-import { S as shouldClearTerminalPresentationForNativeItem, _ as itemName, a as isCodexNotificationForTurn, c as readCodexNotificationTurnId, d as auditNativeToolUnfinishedStatus, l as auditNativeToolName, s as readCodexNotificationThreadId, u as auditNativeToolTerminalStatus, v as itemStatus } from "./turn-router-DBVMToGo.mjs";
+import { S as shouldClearTerminalPresentationForNativeItem, _ as itemName, a as isCodexNotificationForTurn, c as readCodexNotificationTurnId, d as auditNativeToolUnfinishedStatus, l as auditNativeToolName, s as readCodexNotificationThreadId, u as auditNativeToolTerminalStatus, v as itemStatus } from "./turn-router-DdlzuFdm.mjs";
 import { n as resolveCodexAppServerReasoningEffort, t as readCodexSupportedReasoningEfforts } from "./reasoning-effort-CS9kKWB9.mjs";
-import { V as joinPresentSections } from "./thread-requests-BgzJwJtS.mjs";
+import { V as joinPresentSections } from "./thread-requests-BqPhA4Gs.mjs";
 import { r as resolveCodexAppServerRequestModelSelection, t as CODEX_NATIVE_PERSONALITY_NONE } from "./thread-model-selection-DcVebr8N.mjs";
-import { a as requestPluginApprovalOutcome, c as truncateCodexApprovalDisplayText, i as requestPluginApproval, l as waitForPluginApprovalDecision, n as codexApprovalTimeoutText, o as sanitizeCodexApprovalVisibleText, r as mapExecDecisionToOutcome, s as stripDanglingCodexApprovalTerminalSequence, t as approvalRequestExplicitlyUnavailable } from "./plugin-approval-roundtrip-CD88q3yx.mjs";
-import { d as isCodexPassThroughMediaSource, f as mapCodexAppServerLocalWorkspacePath, p as mapCodexAppServerRemoteWorkspacePath } from "./dynamic-tool-build-DcaPmBlE.mjs";
-import { c as emitCodexNativePreToolUseFailureDiagnostic } from "./native-hook-relay-wq7jrNLk.mjs";
+import { a as requestPluginApprovalOutcome, c as truncateCodexApprovalDisplayText, i as requestPluginApproval, l as waitForPluginApprovalDecision, n as codexApprovalTimeoutText, o as sanitizeCodexApprovalVisibleText, r as mapExecDecisionToOutcome, s as stripDanglingCodexApprovalTerminalSequence, t as approvalRequestExplicitlyUnavailable } from "./plugin-approval-roundtrip-HbFUm9Pp.mjs";
+import { d as isCodexPassThroughMediaSource, f as mapCodexAppServerLocalWorkspacePath, p as mapCodexAppServerRemoteWorkspacePath } from "./dynamic-tool-build-CoMf7IKx.mjs";
+import { c as emitCodexNativePreToolUseFailureDiagnostic } from "./native-hook-relay-BQ9UkpeG.mjs";
 import { createRequire } from "node:module";
 import { asNonArrayRecord, asOptionalRecord, filterStringEntries, isRecord, normalizeOptionalString, normalizeTrimmedStringList, readNonBlankString, readStringField } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { createHash, randomUUID } from "node:crypto";

package/dist/.setup/{effective-mcp-catalog-B5HKFZNK.mjs → effective-mcp-catalog-DXGsGC1j.mjs}

@@ -1,8 +1,8 @@
-import { m as sessionBindingIdentity } from "./session-binding-record-DU_0biMD.mjs";
-import { S as retainSharedCodexAppServerClientByInstanceId } from "./auth-cache-key-f8ODJ_OX.mjs";
-import { W as protectCodexAppServerLiveThread } from "./shared-client-BCx1wbyA.mjs";
-import "./session-binding-JEHNMPsr.mjs";
-import { n as projectCodexMcpToolMetadata, t as projectCodexMcpServerMetadata } from "./mcp-tool-metadata-DW41snf3.mjs";
+import { m as sessionBindingIdentity } from "./session-binding-record-C2kDBZhx.mjs";
+import { S as retainSharedCodexAppServerClientByInstanceId } from "./auth-cache-key-DvDLHVJe.mjs";
+import { W as protectCodexAppServerLiveThread } from "./shared-client-wb1JBldZ.mjs";
+import "./session-binding-BDnNz-Co.mjs";
+import { n as projectCodexMcpToolMetadata, t as projectCodexMcpServerMetadata } from "./mcp-tool-metadata-_sawBkIh.mjs";
 import { asOptionalRecord, normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { assignMcpCatalogSafeServerNames } from "openclaw/plugin-sdk/agent-harness-runtime";
 //#region extensions/codex/src/app-server/effective-mcp-catalog.ts
@@ -107,7 +107,7 @@ async function acquireCodexMcpAppRuntime(params, options) {
 	if (!retained && params.prepareSession) {
 		const preparation = await params.prepareSession();
 		params.assertCurrent();
-		const { prepareCodexMcpAppSession } = await import("./mcp-app-session-preparation-Dz2GOwyE.mjs");
+		const { prepareCodexMcpAppSession } = await import("./mcp-app-session-preparation-Cnmuh9RT.mjs");
 		await prepareCodexMcpAppSession({
 			preparation,
 			bindingStore: options.bindingStore,
@@ -128,7 +128,7 @@ async function acquireCodexMcpAppRuntime(params, options) {
 		};
 		params.assertCurrent();
 		assertBinding();
-		const { createNativeMcpRuntime } = await import("./native-mcp-app-DX3nyTtc.mjs").then((n) => n.n);
+		const { createNativeMcpRuntime } = await import("./native-mcp-app-DIheNk35.mjs").then((n) => n.n);
 		params.assertCurrent();
 		const runtime = createNativeMcpRuntime({
 			client: retained.client,

package/dist/.setup/{ephemeral-turn-De3qb8EQ.mjs → ephemeral-turn-C6aFeGFS.mjs}

@@ -1,6 +1,6 @@
 import { i as isJsonObject } from "./protocol-CANUwXJ3.mjs";
-import { x as readCodexTurnCompletedNotification } from "./client-D93nbdB8.mjs";
-import { n as getCodexAppServerTurnRouter } from "./turn-router-DBVMToGo.mjs";
+import { x as readCodexTurnCompletedNotification } from "./client-BpSxNz4F.mjs";
+import { n as getCodexAppServerTurnRouter } from "./turn-router-DdlzuFdm.mjs";
 import { o as isTerminalTurnStatus, s as readCodexNotificationItem, t as CodexUsageProjection } from "./event-projector-usage-BpKfdoTm.mjs";
 import { readStringField } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { toStringifiedError } from "openclaw/plugin-sdk/error-runtime";

package/dist/.setup/{isolated-completion-BPJdvk5F.mjs → isolated-completion-DVDn5GU5.mjs}

@@ -1,10 +1,10 @@
-import { d as readCodexPluginConfig } from "./config-parsing-DsWSCPHO.mjs";
-import { i as resolveCodexAppServerHomeScope } from "./config-options-DDzeNQ8m.mjs";
-import "./config-C1YVVLEA.mjs";
-import { nt as resolveCodexAppServerPreparedAuthHandoff } from "./shared-client-BCx1wbyA.mjs";
-import { f as assertCodexPassiveTurnItems } from "./client-D93nbdB8.mjs";
-import { runBoundedCodexAppServerTurn } from "./bounded-turn-DfIJtRlv.mjs";
-import { t as resolveCodexBoundedTurnIsolation } from "./bounded-turn-isolation-BfDAo-qZ.mjs";
+import { d as readCodexPluginConfig } from "./config-parsing-CVK2Q463.mjs";
+import { i as resolveCodexAppServerHomeScope } from "./config-options-nvYwVDyy.mjs";
+import "./config-G4IGX6bK.mjs";
+import { nt as resolveCodexAppServerPreparedAuthHandoff } from "./shared-client-wb1JBldZ.mjs";
+import { f as assertCodexPassiveTurnItems } from "./client-BpSxNz4F.mjs";
+import { runBoundedCodexAppServerTurn } from "./bounded-turn-BpjZixcd.mjs";
+import { t as resolveCodexBoundedTurnIsolation } from "./bounded-turn-isolation-Brj5qzz6.mjs";
 import { a as createAttributedCodexAssistantMessage } from "./event-projector-assistant-message-CLMKN4x-.mjs";
 //#region extensions/codex/src/app-server/isolated-completion.ts
 /** Runs prompt-only Codex inference on an ephemeral, ring-zero native thread. */

package/dist/.setup/{managed-binary-BtIjV7yN.mjs → managed-binary-DwC9wxch.mjs}

@@ -1,4 +1,4 @@
-import { t as __exportAll } from "./session-binding-sidecars-DD-enC8w.mjs";
+import { t as __exportAll } from "./session-binding-sidecars-DijNZb31.mjs";
 import { createRequire } from "node:module";
 import { resolveGlobalSingleton } from "openclaw/plugin-sdk/global-singleton";
 import { constants, existsSync, realpathSync } from "node:fs";

package/dist/.setup/{mcp-app-session-preparation-Dz2GOwyE.mjs → mcp-app-session-preparation-Cnmuh9RT.mjs}

@@ -1,18 +1,17 @@
-import { m as sessionBindingIdentity } from "./session-binding-record-DU_0biMD.mjs";
-import { d as readCodexRequirementsToml } from "./config-security-clxAZYWX.mjs";
-import { d as readCodexPluginConfig } from "./config-parsing-DsWSCPHO.mjs";
+import { m as sessionBindingIdentity } from "./session-binding-record-C2kDBZhx.mjs";
+import { d as readCodexRequirementsToml } from "./config-security-D0hAOQRI.mjs";
+import { d as readCodexPluginConfig } from "./config-parsing-CVK2Q463.mjs";
 import { n as isCodexAppServerProxyLaunch } from "./launch-args-DbFCehO7.mjs";
-import { i as withCodexAppServerGitConfig } from "./transport-stdio-CRWTkKOn.mjs";
 import { n as buildCodexAppServerRuntimeFingerprint, r as buildCodexPluginAppCacheKey } from "./plugin-app-cache-key-Bg9DbDI6.mjs";
-import { i as resolveCodexBindingAppServerConnection } from "./binding-connection-B7HAAZSI.mjs";
-import { r as resolveOpenClawExecPolicyForCodexAppServer } from "./config-C1YVVLEA.mjs";
+import { i as resolveCodexBindingAppServerConnection } from "./binding-connection-X1ZeEDz8.mjs";
+import { r as resolveOpenClawExecPolicyForCodexAppServer } from "./config-G4IGX6bK.mjs";
 import { r as resolveCodexAppServerAuthProfileId } from "./auth-profile-CgHQ8Vot.mjs";
-import { I as ensureCodexAppServerClientRuntime, c as getLeasedSharedCodexAppServerClient, h as releaseLeasedSharedCodexAppServerClient } from "./shared-client-BCx1wbyA.mjs";
-import { d as mergeCodexThreadConfigs } from "./project-doc-thread-config-BVcvnps8.mjs";
-import { i as resolveCodexSessionBinding } from "./session-binding-JEHNMPsr.mjs";
-import { a as rollbackCodexAppServerBindingSubscription, r as retainCodexAppServerBindingSubscription, t as isSameCodexAppServerThreadOwner } from "./thread-ownership-BoUd0i6L.mjs";
-import { a as prepareCodexPluginThreadConfigStartupProvider, o as resolveCodexPluginThreadConfigStartupPolicy, t as startOrResumeThread } from "./thread-lifecycle-run-C_aYiYqk.mjs";
-import { n as applyCodexSessionPermissionPolicy } from "./session-permission-policy-CD2MAWU8.mjs";
+import { I as ensureCodexAppServerClientRuntime, c as getLeasedSharedCodexAppServerClient, h as releaseLeasedSharedCodexAppServerClient } from "./shared-client-wb1JBldZ.mjs";
+import { d as mergeCodexThreadConfigs } from "./project-doc-thread-config-B2ZD23A_.mjs";
+import { i as resolveCodexSessionBinding } from "./session-binding-BDnNz-Co.mjs";
+import { a as rollbackCodexAppServerBindingSubscription, r as retainCodexAppServerBindingSubscription, t as isSameCodexAppServerThreadOwner } from "./thread-ownership-CTUs8Eyu.mjs";
+import { a as prepareCodexPluginThreadConfigStartupProvider, o as resolveCodexPluginThreadConfigStartupPolicy, t as startOrResumeThread } from "./thread-lifecycle-run-DdwKMIae.mjs";
+import { n as applyCodexSessionPermissionPolicy } from "./session-permission-policy-BYI6mp5u.mjs";
 import { z } from "zod";
 import { loadCodexBundleMcpThreadConfig } from "openclaw/plugin-sdk/agent-harness-runtime";
 import { loadExecApprovals } from "openclaw/plugin-sdk/exec-approvals-runtime";
@@ -76,8 +75,7 @@ async function prepareCodexMcpAppSession(params) {
 				canUseAutoReview: false
 			});
 			const environment = input.hostCapabilities.preparedEnvironment?.();
-			const ownedLocalProcess = appServer.start.transport === "stdio" && !isCodexAppServerProxyLaunch(appServer.start.args) && !appServer.remoteWorkspaceRoot;
-			const baseStartOptions = appServer.start.transport === "stdio" && !isCodexAppServerProxyLaunch(appServer.start.args) ? {
+			const startOptions = appServer.start.transport === "stdio" && !isCodexAppServerProxyLaunch(appServer.start.args) ? {
 				...appServer.start,
 				env: {
 					...appServer.start.env,
@@ -86,8 +84,6 @@ async function prepareCodexMcpAppSession(params) {
 					...environment?.localProcessEnv
 				}
 			} : appServer.start;
-			const shellGitConfigParameters = ownedLocalProcess ? environment?.localGitConfigParameters : void 0;
-			const startOptions = shellGitConfigParameters ? withCodexAppServerGitConfig(baseStartOptions, shellGitConfigParameters) : baseStartOptions;
 			const authProfileId = resolveCodexAppServerAuthProfileId({
 				authProfileId: input.authProfileId ?? admitted.binding?.authProfileId,
 				store: input.authProfileStore,
@@ -168,7 +164,6 @@ async function prepareCodexMcpAppSession(params) {
 					agentDir: input.agentDir,
 					cwd: input.workspaceDir,
 					appServer,
-					shellGitConfigParameters,
 					dynamicTools: [],
 					nativeCodeModeEnabled: false,
 					webSearchAllowed: false,

package/dist/.setup/{mcp-tool-metadata-DW41snf3.mjs → mcp-tool-metadata-_sawBkIh.mjs}

@@ -1,4 +1,4 @@
-import { r as parseCodexPluginMarketplaceId } from "./plugin-marketplace-discovery-BblHM3DU.mjs";
+import { r as parseCodexPluginMarketplaceId } from "./plugin-marketplace-discovery-BNyI1zd_.mjs";
 import { asOptionalRecord, normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { normalizeMcpCodexToolAnnotations, readMcpAppIcons, readMcpAppSettingsCapability, readMcpAppToolExtensions } from "openclaw/plugin-sdk/codex-mcp-projection";
 //#region extensions/codex/src/app-server/mcp-tool-metadata.ts

package/dist/.setup/{model-catalog-ZNwltCKl.mjs → model-catalog-DRbHoUhG.mjs}

@@ -1,15 +1,15 @@
 import { t as buildCodexRuntimeModelParams } from "./model-runtime-BdqzOMkU.mjs";
-import { d as readCodexPluginConfig } from "./config-parsing-DsWSCPHO.mjs";
+import { d as readCodexPluginConfig } from "./config-parsing-CVK2Q463.mjs";
 import { n as isCodexAppServerProxyLaunch } from "./launch-args-DbFCehO7.mjs";
-import { w as retireSharedCodexAppServerClientIfCurrent } from "./auth-cache-key-f8ODJ_OX.mjs";
-import { a as withCodexAppServerJsonClient } from "./request-Bo0kKABI.mjs";
-import { n as resolveCodexAppServerRuntimeOptions } from "./config-runtime-DWzK-k0n.mjs";
+import { w as retireSharedCodexAppServerClientIfCurrent } from "./auth-cache-key-DvDLHVJe.mjs";
+import { a as withCodexAppServerJsonClient } from "./request-DhbisYCc.mjs";
+import { n as resolveCodexAppServerRuntimeOptions } from "./config-runtime-B8agjie6.mjs";
 import { a as resolveCodexAppServerAuthProfileStore, r as resolveCodexAppServerAuthProfileId } from "./auth-profile-CgHQ8Vot.mjs";
-import { r as captureSharedCodexAppServerCatalogLifetime } from "./shared-client-BCx1wbyA.mjs";
+import { r as captureSharedCodexAppServerCatalogLifetime } from "./shared-client-wb1JBldZ.mjs";
 import { i as isCodexResponsesOAuthCredential } from "./responses-oauth-twnuTaAa.mjs";
-import { a as isCodexAppServerIndeterminateRequestCancellationError } from "./client-D93nbdB8.mjs";
-import { n as listAllCodexAppServerModels } from "./models-BHpbAuz8.mjs";
-import { probeCodexNativeAuth } from "./native-auth-esN5MdIv.mjs";
+import { a as isCodexAppServerIndeterminateRequestCancellationError } from "./client-BpSxNz4F.mjs";
+import { n as listAllCodexAppServerModels } from "./models-GBLXb27n.mjs";
+import { probeCodexNativeAuth } from "./native-auth-DWrRSl4Z.mjs";
 //#region extensions/codex/src/app-server/model-catalog.ts
 const INPUT_TYPES = /* @__PURE__ */ new Set([
 	"text",

package/dist/.setup/{models-BHpbAuz8.mjs → models-GBLXb27n.mjs}

@@ -1,4 +1,4 @@
-import { d as assertCodexModelListResponse } from "./client-D93nbdB8.mjs";
+import { d as assertCodexModelListResponse } from "./client-BpSxNz4F.mjs";
 import { normalizeOptionalString, normalizeUniqueTrimmedStringList } from "openclaw/plugin-sdk/string-coerce-runtime";
 //#region extensions/codex/src/app-server/models.ts
 const DEFAULT_MODEL_DISCOVERY_TIMEOUT_MS = 1e4;
@@ -29,8 +29,8 @@ async function listAllCodexAppServerModels(options = {}) {
 async function withCodexAppServerModelRequest(options, run) {
 	if (options.request) return await run(options.request);
 	const timeoutMs = options.timeoutMs ?? 1e4;
-	const { getLeasedSharedCodexAppServerClient, releaseLeasedSharedCodexAppServerClient } = await import("./shared-client-BCx1wbyA.mjs").then((n) => n.v);
-	const { requestCodexAppServerClientJson } = await import("./request-Bo0kKABI.mjs").then((n) => n.i);
+	const { getLeasedSharedCodexAppServerClient, releaseLeasedSharedCodexAppServerClient } = await import("./shared-client-wb1JBldZ.mjs").then((n) => n.v);
+	const { requestCodexAppServerClientJson } = await import("./request-DhbisYCc.mjs").then((n) => n.i);
 	const client = await getLeasedSharedCodexAppServerClient({
 		startOptions: options.startOptions,
 		timeoutMs,

package/dist/.setup/{native-auth-esN5MdIv.mjs → native-auth-DWrRSl4Z.mjs}

@@ -1,8 +1,8 @@
-import { d as readCodexPluginConfig } from "./config-parsing-DsWSCPHO.mjs";
+import { d as readCodexPluginConfig } from "./config-parsing-CVK2Q463.mjs";
 import { n as isCodexAppServerProxyLaunch, t as buildCodexLoginStatusArgs } from "./launch-args-DbFCehO7.mjs";
-import { r as resolveManagedCodexAppServerStartOptions } from "./managed-binary-BtIjV7yN.mjs";
-import { n as resolveCodexAppServerSpawnEnv } from "./transport-stdio-CRWTkKOn.mjs";
-import { n as resolveCodexAppServerRuntimeOptions } from "./config-runtime-DWzK-k0n.mjs";
+import { r as resolveManagedCodexAppServerStartOptions } from "./managed-binary-DwC9wxch.mjs";
+import { n as resolveCodexAppServerSpawnEnv } from "./transport-stdio-lgeKKHyw.mjs";
+import { n as resolveCodexAppServerRuntimeOptions } from "./config-runtime-B8agjie6.mjs";
 import { materializeWindowsSpawnProgram, resolveWindowsSpawnProgram } from "openclaw/plugin-sdk/windows-spawn";
 import { runUtf8CommandWithTimeout } from "openclaw/plugin-sdk/process-runtime";
 //#region extensions/codex/src/app-server/native-auth.ts

package/dist/.setup/{native-hook-relay-wq7jrNLk.mjs → native-hook-relay-BQ9UkpeG.mjs}

@@ -1,9 +1,9 @@
 import { i as isJsonObject } from "./protocol-CANUwXJ3.mjs";
-import { l as fingerprintCodexPolicy } from "./config-security-clxAZYWX.mjs";
-import { D as nativeHookRelayUnregisterQueue } from "./shared-client-BCx1wbyA.mjs";
-import { k as resolveCodexToolAbortTerminalReason } from "./client-D93nbdB8.mjs";
-import { R as normalizeCodexDynamicToolName } from "./thread-requests-BgzJwJtS.mjs";
-import { t as codexNativeSubagentMonitorRuntime } from "./native-subagent-monitor-DOLEIf9r.mjs";
+import { l as fingerprintCodexPolicy } from "./config-security-D0hAOQRI.mjs";
+import { D as nativeHookRelayUnregisterQueue } from "./shared-client-wb1JBldZ.mjs";
+import { k as resolveCodexToolAbortTerminalReason } from "./client-BpSxNz4F.mjs";
+import { R as normalizeCodexDynamicToolName } from "./thread-requests-BqPhA4Gs.mjs";
+import { t as codexNativeSubagentMonitorRuntime } from "./native-subagent-monitor-gqu3TQOv.mjs";
 import { createHash } from "node:crypto";
 import { addTimerTimeoutGraceMs, finiteSecondsToTimerSafeMilliseconds } from "openclaw/plugin-sdk/number-runtime";
 import { escapeRegExp } from "openclaw/plugin-sdk/text-utility-runtime";

package/dist/.setup/{native-mcp-app-DX3nyTtc.mjs → native-mcp-app-DIheNk35.mjs}

@@ -1,9 +1,9 @@
-import { W as protectCodexAppServerLiveThread, _ as retainSharedCodexAppServerClientIfCurrent, n as captureCodexAppServerClientLifetime } from "./shared-client-BCx1wbyA.mjs";
-import { F as getCodexAppServerClientInstanceId } from "./client-D93nbdB8.mjs";
-import { n as getCodexAppServerTurnRouter } from "./turn-router-DBVMToGo.mjs";
-import { a as requestPluginApprovalOutcome } from "./plugin-approval-roundtrip-CD88q3yx.mjs";
-import { i as readCodexMcpToolUiVisibility, n as projectCodexMcpToolMetadata, r as readCodexMcpToolConnectorId, t as projectCodexMcpServerMetadata } from "./mcp-tool-metadata-DW41snf3.mjs";
-import { t as __exportAll } from "./session-binding-sidecars-DD-enC8w.mjs";
+import { W as protectCodexAppServerLiveThread, _ as retainSharedCodexAppServerClientIfCurrent, n as captureCodexAppServerClientLifetime } from "./shared-client-wb1JBldZ.mjs";
+import { F as getCodexAppServerClientInstanceId } from "./client-BpSxNz4F.mjs";
+import { n as getCodexAppServerTurnRouter } from "./turn-router-DdlzuFdm.mjs";
+import { a as requestPluginApprovalOutcome } from "./plugin-approval-roundtrip-HbFUm9Pp.mjs";
+import { i as readCodexMcpToolUiVisibility, n as projectCodexMcpToolMetadata, r as readCodexMcpToolConnectorId, t as projectCodexMcpServerMetadata } from "./mcp-tool-metadata-_sawBkIh.mjs";
+import { t as __exportAll } from "./session-binding-sidecars-DijNZb31.mjs";
 import { asOptionalRecord, normalizeLowercaseStringOrEmpty, normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { z } from "zod";
 import { loadAgentHarnessMcpConfig, prepareHarnessNativeMcpAppPreview } from "openclaw/plugin-sdk/agent-harness-runtime";

package/dist/.setup/{native-skill-isolation-DSBeF-Yy.mjs → native-skill-isolation-CxZRtiWZ.mjs}

@@ -1,9 +1,9 @@
 import { i as isJsonObject } from "./protocol-CANUwXJ3.mjs";
 import { n as resolveCodexAppServerLocalHomeDir } from "./auth-start-options-BPIPeEX8.mjs";
 import { t as buildCodexAppServerConnectionFingerprint } from "./plugin-app-cache-key-Bg9DbDI6.mjs";
-import { G as readCodexClientSessionMeta } from "./shared-client-BCx1wbyA.mjs";
-import { f as unsubscribeCodexThreadBestEffort, n as CODEX_APP_SERVER_UNSUBSCRIBE_TIMEOUT_MS } from "./attempt-client-cleanup-zNuNTKVr.mjs";
-import { b as codexDynamicToolsFingerprint, p as attestCodexRestrictedToolSurfaceMcpServersDisabled } from "./thread-requests-BgzJwJtS.mjs";
+import { G as readCodexClientSessionMeta } from "./shared-client-wb1JBldZ.mjs";
+import { f as unsubscribeCodexThreadBestEffort, n as CODEX_APP_SERVER_UNSUBSCRIBE_TIMEOUT_MS } from "./attempt-client-cleanup-TScCVTsk.mjs";
+import { b as codexDynamicToolsFingerprint, p as attestCodexRestrictedToolSurfaceMcpServersDisabled } from "./thread-requests-BqPhA4Gs.mjs";
 import path from "node:path";
 import os from "node:os";
 import fs from "node:fs/promises";

package/dist/.setup/{native-subagent-monitor-DOLEIf9r.mjs → native-subagent-monitor-gqu3TQOv.mjs}

@@ -1,17 +1,17 @@
 import { c as codexNativeSubagentRunId, d as readNativeSubagentThreadIds, f as readThreadParentThreadId, l as normalizeIdentifier, m as assertHistoryOwnerMatchesRegistration, p as readThreadSpawnSource, t as matchesNativeAssignmentLifecycle, u as readCodexNativeSubagentRunId } from "./native-subagent-pending-assignments-DmVhedNs.mjs";
 import { i as isJsonObject } from "./protocol-CANUwXJ3.mjs";
-import { n as defineCodexBuildState } from "./build-state-Ds14X10-.mjs";
+import { n as defineCodexBuildState } from "./build-state-DfrctLQv.mjs";
 import { a as readHookOutputEntries, o as readItem, s as readNullableString } from "./event-projector-values-CLvG1Hil.mjs";
 import { n as attachCodexMirrorIdentity } from "./upstream-prompt-provenance-Ccd9MFRJ.mjs";
 import { t as readCodexMirroredSessionHistoryMessages } from "./session-history-BO6i_pfk.mjs";
-import { P as claimCodexAppServerLiveThread, R as hasCodexAppServerLiveThread, q as retainCodexAppServerLiveThread } from "./shared-client-BCx1wbyA.mjs";
-import { M as readCodexAppServerWarningMessage } from "./client-D93nbdB8.mjs";
-import { C as unknownItemStatus, _ as itemName, b as matchesCodexSnapshotTurn, f as isMutatingNativeToolItem, g as itemKind, h as isSideEffectingNativeToolItem, l as auditNativeToolName, m as isProjectedNativeToolItem, p as isNonSuccessItemStatus, u as auditNativeToolTerminalStatus, v as itemStatus, y as itemTitle } from "./turn-router-DBVMToGo.mjs";
-import { s as interruptCodexTurnAndWaitBestEffort } from "./attempt-client-cleanup-zNuNTKVr.mjs";
+import { P as claimCodexAppServerLiveThread, R as hasCodexAppServerLiveThread, q as retainCodexAppServerLiveThread } from "./shared-client-wb1JBldZ.mjs";
+import { M as readCodexAppServerWarningMessage } from "./client-BpSxNz4F.mjs";
+import { C as unknownItemStatus, _ as itemName, b as matchesCodexSnapshotTurn, f as isMutatingNativeToolItem, g as itemKind, h as isSideEffectingNativeToolItem, l as auditNativeToolName, m as isProjectedNativeToolItem, p as isNonSuccessItemStatus, u as auditNativeToolTerminalStatus, v as itemStatus, y as itemTitle } from "./turn-router-DdlzuFdm.mjs";
+import { s as interruptCodexTurnAndWaitBestEffort } from "./attempt-client-cleanup-TScCVTsk.mjs";
 import { t as projectCodexWebSearchItem } from "./web-search-item-CvokaZOo.mjs";
-import { n as codexApprovalTimeoutText } from "./plugin-approval-roundtrip-CD88q3yx.mjs";
+import { n as codexApprovalTimeoutText } from "./plugin-approval-roundtrip-HbFUm9Pp.mjs";
 import { t as resolveCodexLocalRuntimeAttribution } from "./local-runtime-attribution-CZz2DJ4q.mjs";
-import { t as __exportAll } from "./session-binding-sidecars-DD-enC8w.mjs";
+import { t as __exportAll } from "./session-binding-sidecars-DijNZb31.mjs";
 import { asFiniteNumber, asNonArrayRecord, normalizeOptionalString, readStringField } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { randomUUID } from "node:crypto";
 import { asDateTimestampMs } from "openclaw/plugin-sdk/number-runtime";

package/dist/.setup/{native-task-assignments-DimsQ9Qa.mjs → native-task-assignments-DYL9uxNe.mjs}

@@ -56,7 +56,7 @@ async function inspect(params) {
 		if (extractErrorCode(error) === "ENOENT") return [];
 		throw error;
 	}
-	const { bindingStoreKey, readStoredCodexAppServerBinding } = await import("./session-binding-record-DU_0biMD.mjs").then((n) => n.h);
+	const { bindingStoreKey, readStoredCodexAppServerBinding } = await import("./session-binding-record-C2kDBZhx.mjs").then((n) => n.h);
 	const { executeSqliteQuerySync, getNodeSqliteKysely, openNodeSqliteDatabase, prepareSqliteReadOnlyLocation, tableExists } = await import("openclaw/plugin-sdk/sqlite-runtime");
 	const snapshot = await prepareSqliteReadOnlyLocation(source, { preserveSourceArtifacts: true });
 	try {
@@ -126,7 +126,7 @@ function prepareAssignment(task, stored, params, { getSessionEntry, resolveStore
 }
 async function settleHistoricalDelivery(task, key, observedBinding, params, sessionStore) {
 	const { executeSqliteQuerySync, getNodeSqliteKysely, openNodeSqliteDatabase, resolveExistingSqliteFileUri, runSqliteImmediateTransactionSync } = await import("openclaw/plugin-sdk/sqlite-runtime");
-	const { readStoredCodexAppServerBinding } = await import("./session-binding-record-DU_0biMD.mjs").then((n) => n.h);
+	const { readStoredCodexAppServerBinding } = await import("./session-binding-record-C2kDBZhx.mjs").then((n) => n.h);
 	const db = openNodeSqliteDatabase(resolveExistingSqliteFileUri(databasePath(params)));
 	try {
 		const sql = getNodeSqliteKysely(db);
@@ -170,7 +170,7 @@ const codexNativeTaskAssignmentMigration = {
 			changes: [],
 			warnings
 		};
-		const { bindingStoreKey, readStoredCodexAppServerBinding } = await import("./session-binding-record-DU_0biMD.mjs").then((n) => n.h);
+		const { bindingStoreKey, readStoredCodexAppServerBinding } = await import("./session-binding-record-C2kDBZhx.mjs").then((n) => n.h);
 		const sessionStore = await import("openclaw/plugin-sdk/session-store-runtime");
 		let imported = 0;
 		let settled = 0;

package/dist/.setup/{node-cli-sessions-CzKg2nGq.mjs → node-cli-sessions-BxVYZNuY.mjs}

@@ -1,4 +1,4 @@
-import { A as unwrapNodeInvokePayload, x as readBoundedOptionalString } from "./session-catalog-parsing-DkeoVn60.mjs";
+import { A as unwrapNodeInvokePayload, x as readBoundedOptionalString } from "./session-catalog-parsing-B4OyhylL.mjs";
 import { r as resolveCodexAppServerUserHomeDir } from "./auth-start-options-BPIPeEX8.mjs";
 import { o as formatCodexDisplayText } from "./command-formatters-xW9KpoSZ.mjs";
 import { t as codexCatalogHomeId } from "./session-catalog-home-id-vlih0B_g.mjs";
@@ -196,7 +196,7 @@ async function resumeCodexCliSessionOnNode(params) {
 	let catalogAgentId;
 	let catalogHomeId;
 	if (params.sessionKey) {
-		const { adoptionSessionKeyRest, CODEX_NODE_SESSION_KEY_PREFIX, readNodeSessionMarker } = await import("./session-catalog-node-adoption-BdP9Zjqo.mjs");
+		const { adoptionSessionKeyRest, CODEX_NODE_SESSION_KEY_PREFIX, readNodeSessionMarker } = await import("./session-catalog-node-adoption-D11N0CMr.mjs");
 		const entry = params.runtime.agent.session.getSessionEntry({
 			sessionKey: params.sessionKey,
 			readConsistency: "latest"

package/dist/.setup/{node-exec-server.runtime-BWkULhBM.mjs → node-exec-server.runtime-8RehgPdQ.mjs}

@@ -1,5 +1,5 @@
-import { i as resolveManagedCodexNativeCommand, r as resolveManagedCodexAppServerStartOptions, t as isManagedCodexDesktopCommand } from "./managed-binary-BtIjV7yN.mjs";
-import { o as closeCodexAppServerTransportAndWait, t as createStdioTransport } from "./transport-stdio-CRWTkKOn.mjs";
+import { i as resolveManagedCodexNativeCommand, r as resolveManagedCodexAppServerStartOptions, t as isManagedCodexDesktopCommand } from "./managed-binary-DwC9wxch.mjs";
+import { a as closeCodexAppServerTransportAndWait, t as createStdioTransport } from "./transport-stdio-lgeKKHyw.mjs";
 import { isRecord } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { stripVTControlCharacters } from "node:util";
 import { killProcessTree } from "openclaw/plugin-sdk/process-runtime";

package/dist/.setup/{plan-41-YOBMq.mjs → plan-DZWYASAx.mjs}

@@ -1,7 +1,7 @@
 import { t as isOnlyMigrationKind } from "./scope-DOC1Xjc8.mjs";
-import { u as CODEX_PLUGINS_MARKETPLACE_NAME } from "./plugin-inventory-CYgdo14P.mjs";
-import "./config-C1YVVLEA.mjs";
-import { i as hasCodexSource, n as defaultCodexHome, o as readJsonObject, r as discoverCodexSource, s as sanitizeName, t as codexPluginMigrationSubscriptionWarning } from "./source-DipMO9hL.mjs";
+import { u as CODEX_PLUGINS_MARKETPLACE_NAME } from "./plugin-inventory-kLR7G02h.mjs";
+import "./config-G4IGX6bK.mjs";
+import { i as hasCodexSource, n as defaultCodexHome, o as readJsonObject, r as discoverCodexSource, s as sanitizeName, t as codexPluginMigrationSubscriptionWarning } from "./source-BjBw-zoV.mjs";
 import { asBoolean, asOptionalRecord, isRecord, normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { createHash } from "node:crypto";
 import { runCommandBuffered } from "openclaw/plugin-sdk/process-runtime";
@@ -97,8 +97,8 @@ async function readCodexCliCredentialsAsync(options) {
 	options.signal?.throwIfAborted();
 	if (!options.allowKeychainPrompt) return;
 	const home = await fs.realpath(options.codexHome).catch(() => path.resolve(options.codexHome));
-	const { CodexAppServerClient } = await import("./client-D93nbdB8.mjs").then((n) => n.n);
-	const { resolveManagedCodexPackageEntrypoint, resolveManagedCodexNativeCommand } = await import("./managed-binary-BtIjV7yN.mjs").then((n) => n.n);
+	const { CodexAppServerClient } = await import("./client-BpSxNz4F.mjs").then((n) => n.n);
+	const { resolveManagedCodexPackageEntrypoint, resolveManagedCodexNativeCommand } = await import("./managed-binary-DwC9wxch.mjs").then((n) => n.n);
 	const launcher = resolveManagedCodexPackageEntrypoint(path.dirname(fileURLToPath(import.meta.url)));
 	const command = launcher ? resolveManagedCodexNativeCommand(launcher) : void 0;
 	if (!command) return;

package/dist/.setup/{plugin-activation-D7WkJMvU.mjs → plugin-activation-CsW09DWl.mjs}

@@ -1,6 +1,6 @@
 import { r as CodexAppServerRpcError } from "./rpc-error-C98SHchT.mjs";
-import { i as listCodexPluginMetadata, n as findCodexMarketplacePluginSummary, o as pluginReadParams, r as isOpenAiCuratedMarketplaceName, t as createCodexAppInventoryRequest, u as CODEX_PLUGINS_MARKETPLACE_NAME } from "./plugin-inventory-CYgdo14P.mjs";
-import "./config-C1YVVLEA.mjs";
+import { i as listCodexPluginMetadata, n as findCodexMarketplacePluginSummary, o as pluginReadParams, r as isOpenAiCuratedMarketplaceName, t as createCodexAppInventoryRequest, u as CODEX_PLUGINS_MARKETPLACE_NAME } from "./plugin-inventory-kLR7G02h.mjs";
+import "./config-G4IGX6bK.mjs";
 import { coerceErrorMessage } from "openclaw/plugin-sdk/error-runtime";
 //#region extensions/codex/src/app-server/plugin-activation.ts
 /** Activates legacy curated plugins without granting install authority to other marketplaces. */

package/dist/.setup/{plugin-approval-roundtrip-CD88q3yx.mjs → plugin-approval-roundtrip-HbFUm9Pp.mjs}

@@ -1,4 +1,4 @@
-import { mt as resolveCodexGatewayTimeoutWithGraceMs } from "./shared-client-BCx1wbyA.mjs";
+import { mt as resolveCodexGatewayTimeoutWithGraceMs } from "./shared-client-wb1JBldZ.mjs";
 import { truncateUtf16Safe } from "openclaw/plugin-sdk/text-utility-runtime";
 import { isApprovalNotFoundError, toErrorObject } from "openclaw/plugin-sdk/error-runtime";
 import { racePromiseWithAbortSignal } from "openclaw/plugin-sdk/time-runtime";

package/dist/.setup/{plugin-inventory-CYgdo14P.mjs → plugin-inventory-kLR7G02h.mjs}

@@ -1,5 +1,5 @@
 import { c as findCodexAppById } from "./plugin-app-cache-key-Bg9DbDI6.mjs";
-import "./config-C1YVVLEA.mjs";
+import "./config-G4IGX6bK.mjs";
 import { embeddedAgentLog } from "openclaw/plugin-sdk/agent-harness-runtime";
 //#region extensions/codex/src/app-server/config-contracts.ts
 const CODEX_PLUGINS_MARKETPLACE_NAME = "openai-curated";

package/dist/.setup/{plugin-marketplace-discovery-BblHM3DU.mjs → plugin-marketplace-discovery-BNyI1zd_.mjs}

@@ -1,4 +1,4 @@
-import { t as CODEX_PLUGIN_MARKETPLACE_NAME_PATTERN } from "./config-contracts.shared-D85SGEuq.mjs";
+import { n as CODEX_PLUGIN_MARKETPLACE_NAME_PATTERN } from "./service-tier-normalization-C2OVdF6E.mjs";
 import { asOptionalRecord } from "openclaw/plugin-sdk/string-coerce-runtime";
 //#region extensions/codex/src/plugin-marketplace-discovery.ts
 /** Read-only discovery of Codex-owned local, curated, and remote plugin marketplaces. */

package/dist/.setup/{project-doc-thread-config-BVcvnps8.mjs → project-doc-thread-config-B2ZD23A_.mjs}

@@ -1,11 +1,11 @@
 import { i as isJsonObject } from "./protocol-CANUwXJ3.mjs";
-import { l as fingerprintCodexPolicy } from "./config-security-clxAZYWX.mjs";
-import { f as resolveCodexPluginsPolicy } from "./config-parsing-DsWSCPHO.mjs";
-import { u as CODEX_SESSION_OVERRIDABLE_LAYER_TYPES } from "./config-options-DDzeNQ8m.mjs";
+import { l as fingerprintCodexPolicy } from "./config-security-D0hAOQRI.mjs";
+import { f as resolveCodexPluginsPolicy } from "./config-parsing-CVK2Q463.mjs";
+import { u as CODEX_SESSION_OVERRIDABLE_LAYER_TYPES } from "./config-options-nvYwVDyy.mjs";
 import { a as defaultCodexAppInventoryCache, i as CodexAppInventoryCache, o as serializeCodexAppInventoryError, s as codexAppIdentityKey } from "./plugin-app-cache-key-Bg9DbDI6.mjs";
-import { l as toCodexPluginOwnedAccountApp, s as readCodexPluginInventory, t as createCodexAppInventoryRequest } from "./plugin-inventory-CYgdo14P.mjs";
-import "./config-C1YVVLEA.mjs";
-import { t as ensureCodexPluginActivation } from "./plugin-activation-D7WkJMvU.mjs";
+import { l as toCodexPluginOwnedAccountApp, s as readCodexPluginInventory, t as createCodexAppInventoryRequest } from "./plugin-inventory-kLR7G02h.mjs";
+import "./config-G4IGX6bK.mjs";
+import { t as ensureCodexPluginActivation } from "./plugin-activation-CsW09DWl.mjs";
 import { embeddedAgentLog } from "openclaw/plugin-sdk/agent-harness-runtime";
 //#region extensions/codex/src/app-server/plugin-app-approval-overrides.ts
 /** Projects ask approvals into the native session layer without changing saved settings. */

package/dist/.setup/{provider-LWKll6dV.mjs → provider-BiUzaRth.mjs}

@@ -11,7 +11,7 @@ function buildCodexMigrationProvider(params = {}) {
 		].join(" "),
 		supportedItemKinds: ["memory", "auth"],
 		async detect(ctx) {
-			const { discoverCodexSource, hasCodexSource } = await import("./source-DipMO9hL.mjs").then((n) => n.a);
+			const { discoverCodexSource, hasCodexSource } = await import("./source-BjBw-zoV.mjs").then((n) => n.a);
 			const memoryOnly = isOnlyMigrationKind(ctx, "memory");
 			const authOnly = isOnlyMigrationKind(ctx, "auth");
 			const source = await discoverCodexSource({
@@ -29,16 +29,16 @@ function buildCodexMigrationProvider(params = {}) {
 			};
 		},
 		async plan(ctx) {
-			const { buildCodexMigrationPlan } = await import("./plan-41-YOBMq.mjs");
+			const { buildCodexMigrationPlan } = await import("./plan-DZWYASAx.mjs");
 			return buildCodexMigrationPlan(ctx);
 		},
 		deferredApply: { retrySafe: true },
 		prepareApply(ctx) {
 			if (isOnlyMigrationKind(ctx, "memory") || isOnlyMigrationKind(ctx, "auth")) return;
-			return import("./apply-BXDMd05l.mjs").then(({ prepareTargetCodexAppServer }) => prepareTargetCodexAppServer(ctx));
+			return import("./apply-QyZT5-na.mjs").then(({ prepareTargetCodexAppServer }) => prepareTargetCodexAppServer(ctx));
 		},
 		async apply(ctx, plan) {
-			const { applyCodexMigrationPlan } = await import("./apply-BXDMd05l.mjs");
+			const { applyCodexMigrationPlan } = await import("./apply-QyZT5-na.mjs");
 			return await applyCodexMigrationPlan({
 				ctx,
 				plan,

package/dist/.setup/{provider-capabilities-Dn2WwH4P.mjs → provider-capabilities-DOBUBt86.mjs}

@@ -1,4 +1,4 @@
-import { h as releaseLeasedSharedCodexAppServerClient } from "./shared-client-BCx1wbyA.mjs";
+import { h as releaseLeasedSharedCodexAppServerClient } from "./shared-client-wb1JBldZ.mjs";
 //#region extensions/codex/src/app-server/provider-capabilities.ts
 function resolveOverriddenProviderWebSearchSupport(modelProviderOverride) {
 	const provider = modelProviderOverride?.trim().toLowerCase();

package/dist/.setup/{request-Bo0kKABI.mjs → request-DhbisYCc.mjs}

@@ -1,7 +1,7 @@
 import { i as CodexAppServerScopedRequestRejectedError, r as CodexAppServerRpcError } from "./rpc-error-C98SHchT.mjs";
 import { t as CODEX_CONTROL_METHODS } from "./capabilities-DbOzOglY.mjs";
 import { i as withTimeout$1, r as withAbortableTimeout } from "./timeout-D0mEWSGG.mjs";
-import { t as __exportAll } from "./session-binding-sidecars-DD-enC8w.mjs";
+import { t as __exportAll } from "./session-binding-sidecars-DijNZb31.mjs";
 import { embeddedAgentLog } from "openclaw/plugin-sdk/agent-harness-registration";
 import { areDiagnosticsEnabledForProcess } from "openclaw/plugin-sdk/diagnostic-runtime";
 import { raceWithTimeout } from "openclaw/plugin-sdk/time-runtime";
@@ -164,7 +164,7 @@ async function requestCodexAppServerClientJson(params) {
 	let phase = "prepare";
 	observeControl(params.controlObservation, phase);
 	try {
-		const { resolveCodexAppServerDirectSandboxBypassBlock } = await import("./sandbox-guard-DIImwCy1.mjs").then((n) => n.r);
+		const { resolveCodexAppServerDirectSandboxBypassBlock } = await import("./sandbox-guard-Cf9XMRrg.mjs").then((n) => n.r);
 		const sandboxBlock = resolveCodexAppServerDirectSandboxBypassBlock(params);
 		if (sandboxBlock) throw new Error(sandboxBlock);
 		const timeoutMs = params.timeoutMs ?? 6e4;
@@ -188,7 +188,7 @@ async function requestCodexAppServerClientJson(params) {
 }
 async function requestCodexAppServerJson(params) {
 	observeControl(params.controlObservation, "prepare");
-	const { resolveCodexAppServerDirectSandboxBypassBlock } = await import("./sandbox-guard-DIImwCy1.mjs").then((n) => n.r);
+	const { resolveCodexAppServerDirectSandboxBypassBlock } = await import("./sandbox-guard-Cf9XMRrg.mjs").then((n) => n.r);
 	const sandboxBlock = resolveCodexAppServerDirectSandboxBypassBlock(params);
 	if (sandboxBlock) throw new Error(sandboxBlock);
 	return await withCodexAppServerJsonClient({
@@ -292,8 +292,8 @@ async function withCodexAppServerJsonClient(params, run) {
 			timeoutMs,
 			timeoutMessage,
 			promise: (async () => {
-				const { resolveCodexAppServerDirectSandboxBypassBlock } = await import("./sandbox-guard-DIImwCy1.mjs").then((n) => n.r);
-				const { createIsolatedCodexAppServerClient, getLeasedSharedCodexAppServerClient, isCodexAppServerStartSelectionChangedError, releaseLeasedSharedCodexAppServerClient, retireSharedCodexAppServerClientIfCurrent } = await import("./shared-client-BCx1wbyA.mjs").then((n) => n.v);
+				const { resolveCodexAppServerDirectSandboxBypassBlock } = await import("./sandbox-guard-Cf9XMRrg.mjs").then((n) => n.r);
+				const { createIsolatedCodexAppServerClient, getLeasedSharedCodexAppServerClient, isCodexAppServerStartSelectionChangedError, releaseLeasedSharedCodexAppServerClient, retireSharedCodexAppServerClientIfCurrent } = await import("./shared-client-wb1JBldZ.mjs").then((n) => n.v);
 				for (let attempt = 0; attempt < 2; attempt += 1) {
 					errorPhase = void 0;
 					setPhase("prepare");