@openclaw/codex 2026.10.5-beta.4 → 2026.10.6

package/dist/.setup/{thread-lifecycle-run-C_aYiYqk.mjs → thread-lifecycle-run-DjSfTw6v.mjs}

@@ -1,11 +1,11 @@
 import { i as isJsonObject, r as flattenCodexDynamicToolFunctions } from "./protocol-CANUwXJ3.mjs";
-import { n as matchesPendingSupervisionBranch } from "./session-binding-record-codec-BpH8u_G9.mjs";
-import { m as sessionBindingIdentity, n as assertCodexBindingMayBeReplaced } from "./session-binding-record-DU_0biMD.mjs";
-import { l as fingerprintCodexPolicy } from "./config-security-clxAZYWX.mjs";
-import { f as resolveCodexPluginsPolicy } from "./config-parsing-DsWSCPHO.mjs";
+import { n as matchesPendingSupervisionBranch } from "./session-binding-record-codec-CWQXr9os.mjs";
+import { m as sessionBindingIdentity, n as assertCodexBindingMayBeReplaced } from "./session-binding-record-C2kDBZhx.mjs";
+import { l as fingerprintCodexPolicy } from "./config-security-DpkGNy5T.mjs";
+import { f as resolveCodexPluginsPolicy } from "./config-parsing-CVK2Q463.mjs";
 import { n as resolveCodexAppServerLocalHomeDir, t as resolveCodexAppServerHomeDir } from "./auth-start-options-BPIPeEX8.mjs";
-import { d as readCodexEffectiveConfig, s as assertCodexModelBackedReviewerEffectiveConfig, u as CODEX_SESSION_OVERRIDABLE_LAYER_TYPES } from "./config-options-DDzeNQ8m.mjs";
-import { S as retainSharedCodexAppServerClientByInstanceId, d as getCurrentSharedClientEntry } from "./auth-cache-key-f8ODJ_OX.mjs";
+import { d as readCodexEffectiveConfig, s as assertCodexModelBackedReviewerEffectiveConfig, u as CODEX_SESSION_OVERRIDABLE_LAYER_TYPES } from "./config-options-CZmH25Xq.mjs";
+import { S as retainSharedCodexAppServerClientByInstanceId, d as getCurrentSharedClientEntry } from "./auth-cache-key-CXK7tmkb.mjs";
 import { t as withCodexAppServerThreadMutation } from "./thread-ownership-queue-CeyYScUC.mjs";
 import { o as isCodexAppServerOverloadError, r as CodexAppServerRpcError, s as isCodexThreadReadMissingError } from "./rpc-error-C98SHchT.mjs";
 import { t as codexCatalogHomeId } from "./session-catalog-home-id-vlih0B_g.mjs";
@@ -13,34 +13,34 @@ import { r as withAbortableTimeout } from "./timeout-D0mEWSGG.mjs";
 import { t as projectBoundedCodexThreadHistory } from "./transcript-history-projection-DfKcoZCB.mjs";
 import { a as defaultCodexAppInventoryCache, t as buildCodexAppServerConnectionFingerprint } from "./plugin-app-cache-key-Bg9DbDI6.mjs";
 import { n as readCodexSessionMeta } from "./session-catalog-provenance-CmsOE5mh.mjs";
-import { t as assertCodexSessionRuntimeOwnership } from "./binding-connection-B7HAAZSI.mjs";
-import { c as resolveRecoverableCodexPluginConfigKeys } from "./plugin-inventory-CYgdo14P.mjs";
-import "./config-C1YVVLEA.mjs";
+import { t as assertCodexSessionRuntimeOwnership } from "./binding-connection-C0t9TBX_.mjs";
+import { c as resolveRecoverableCodexPluginConfigKeys } from "./plugin-inventory-OhiCoyPH.mjs";
+import "./config-LQemoqTL.mjs";
 import { c as resolveCodexContextEngineProjectionMaxChars } from "./context-engine-projection-ps-yn_ci.mjs";
 import { n as normalizeCodexAppServerBindingModelProvider } from "./auth-profile-CgHQ8Vot.mjs";
-import { $ as createCodexEphemeralThreadPolicy, A as bindCodexInferenceThread, B as isCodexAppServerClientRuntimeLive, C as CodexThreadBindingConflictError, F as consumeCodexAppServerLiveThread, H as isCodexAppServerLiveThreadProtected, K as releaseCodexAppServerLiveThread, M as getCodexInferenceThreadQualification, N as prepareCodexInferenceThreadConfig, S as CodexAdoptedThreadActiveError, T as CodexThreadStartRequestError, V as isCodexAppServerLiveThreadClaimed, Y as unsubscribeCodexAppServerLiveThread, j as getCodexInferenceThread, k as assertCodexInferenceRouteConfig, n as captureCodexAppServerClientLifetime, w as CodexThreadClientReplacementError, z as hasCodexAppServerSiblingThreadWork } from "./shared-client-BCx1wbyA.mjs";
-import { C as resolveCodexThreadRolloutPath, F as getCodexAppServerClientInstanceId, L as resolveCodexAppServerClientInstanceId, S as readSupervisionResponseThreadId, c as isCodexAppServerRequestTimeoutError, g as assertCodexThreadStartResponse, m as assertCodexThreadForkResponse, p as assertCodexThreadAcceptsDirectInput, v as assertExactSupervisionModelSelection } from "./client-D93nbdB8.mjs";
-import { r as hasCodexAppServerSiblingRouteWork } from "./turn-router-DBVMToGo.mjs";
-import { f as unsubscribeCodexThreadBestEffort, l as retireUnsafeCodexTurnClientBestEffort, n as CODEX_APP_SERVER_UNSUBSCRIBE_TIMEOUT_MS, o as closeCodexStartupClientBestEffort, r as CodexAppServerUnsafeSubscriptionError } from "./attempt-client-cleanup-zNuNTKVr.mjs";
-import { a as buildCodexPluginThreadConfigInputFingerprint, c as buildPluginAppPolicyContext, d as mergeCodexThreadConfigs, i as buildCodexPluginThreadConfig, l as disableUnlistedCodexApps, m as buildCodexAppApprovalOverrides, n as mergeCodexNativeProjectDocThreadConfig, o as buildCodexPluginThreadConfigTimeoutFallback, p as shouldBuildCodexPluginThreadConfig, r as buildCodexPluginAppsConfigPatchFromPolicyContext, u as isCodexPluginThreadBindingStale } from "./project-doc-thread-config-BVcvnps8.mjs";
-import { A as isTransientWebSearchRestriction, C as fingerprintEnvironmentSelection, D as readActiveCodexTurnIdsFromResume, E as legacyFingerprintUserMcpServersConfigPatch, I as isMessageOnlyCodexSourceReply, L as isSystemAgentOnlyCodexDynamicToolAllowlist, M as shouldRotateCodexAppServerBindingForRuntime, N as shouldRotateCodexGpt56MultiAgentBinding, O as shouldStartTransientNoToolThread, S as fingerprintCodexThreadConfig, T as fingerprintUserMcpServersConfigPatch, _ as buildDeveloperInstructions, b as codexDynamicToolsFingerprint, c as codexThreadSandboxOrPermissions, d as readCodexManagedRequirementsFingerprint, f as resolveCodexThreadApprovalsReviewer, g as mergeCodexNativeShellEnvironment, h as resolveCodexWebSearchPlan, i as buildCodexRuntimeThreadConfigForRun, j as shouldRecheckRecoverablePluginBinding, n as buildCodexRingZeroThreadConfigPatch, o as buildThreadResumeParams, p as attestCodexRestrictedToolSurfaceMcpServersDisabled, s as buildThreadStartParams, t as assertCodexManagedRequirementsDoNotOverrideToolPolicy, u as readCodexInheritedMcpServerNames, v as areCodexDynamicToolFingerprintsCompatible, w as fingerprintJsonObject, x as codexLegacyDynamicToolsFingerprint, y as areUserMcpServersFingerprintsCompatible } from "./thread-requests-BgzJwJtS.mjs";
-import { i as resolveCodexSessionBinding, o as hashCodexAppServerBindingFingerprint } from "./session-binding-JEHNMPsr.mjs";
+import { A as bindCodexInferenceThread, B as isCodexAppServerClientRuntimeLive, C as CodexThreadBindingConflictError, F as consumeCodexAppServerLiveThread, H as isCodexAppServerLiveThreadClaimed, M as getCodexInferenceThreadQualification, N as prepareCodexInferenceThreadConfig, S as CodexAdoptedThreadActiveError, T as CodexThreadStartRequestError, U as isCodexAppServerLiveThreadProtected, V as isCodexAppServerLiveThreadBackgroundOnly, X as unsubscribeCodexAppServerLiveThread, et as createCodexEphemeralThreadPolicy, j as getCodexInferenceThread, k as assertCodexInferenceRouteConfig, n as captureCodexAppServerClientLifetime, q as releaseCodexAppServerLiveThread, w as CodexThreadClientReplacementError, z as hasCodexAppServerSiblingThreadWork } from "./shared-client-CNGDTv68.mjs";
+import { C as resolveCodexThreadRolloutPath, F as getCodexAppServerClientInstanceId, L as resolveCodexAppServerClientInstanceId, S as readSupervisionResponseThreadId, c as isCodexAppServerRequestTimeoutError, g as assertCodexThreadStartResponse, m as assertCodexThreadForkResponse, p as assertCodexThreadAcceptsDirectInput, v as assertExactSupervisionModelSelection } from "./client-Div-zqnz.mjs";
+import { r as hasCodexAppServerSiblingRouteWork } from "./turn-router-DM0fRrYI.mjs";
+import { f as unsubscribeCodexThreadBestEffort, l as retireUnsafeCodexTurnClientBestEffort, n as CODEX_APP_SERVER_UNSUBSCRIBE_TIMEOUT_MS, o as closeCodexStartupClientBestEffort, r as CodexAppServerUnsafeSubscriptionError } from "./attempt-client-cleanup-BVww-ct8.mjs";
+import { a as buildCodexPluginThreadConfigInputFingerprint, c as buildPluginAppPolicyContext, d as mergeCodexThreadConfigs, i as buildCodexPluginThreadConfig, l as disableUnlistedCodexApps, m as buildCodexAppApprovalOverrides, n as mergeCodexNativeProjectDocThreadConfig, o as buildCodexPluginThreadConfigTimeoutFallback, p as shouldBuildCodexPluginThreadConfig, r as buildCodexPluginAppsConfigPatchFromPolicyContext, u as isCodexPluginThreadBindingStale } from "./project-doc-thread-config-D_sWbxFR.mjs";
+import { A as isTransientWebSearchRestriction, C as fingerprintEnvironmentSelection, D as readActiveCodexTurnIdsFromResume, E as legacyFingerprintUserMcpServersConfigPatch, I as isMessageOnlyCodexSourceReply, L as isSystemAgentOnlyCodexDynamicToolAllowlist, M as shouldRotateCodexAppServerBindingForRuntime, N as shouldRotateCodexGpt56MultiAgentBinding, O as shouldStartTransientNoToolThread, S as fingerprintCodexThreadConfig, T as fingerprintUserMcpServersConfigPatch, _ as buildDeveloperInstructions, b as codexDynamicToolsFingerprint, c as codexThreadSandboxOrPermissions, d as readCodexManagedRequirementsFingerprint, f as resolveCodexThreadApprovalsReviewer, g as mergeCodexNativeShellEnvironment, h as resolveCodexWebSearchPlan, i as buildCodexRuntimeThreadConfigForRun, j as shouldRecheckRecoverablePluginBinding, n as buildCodexRingZeroThreadConfigPatch, o as buildThreadResumeParams, p as attestCodexRestrictedToolSurfaceMcpServersDisabled, s as buildThreadStartParams, t as assertCodexManagedRequirementsDoNotOverrideToolPolicy, u as readCodexInheritedMcpServerNames, v as areCodexDynamicToolFingerprintsCompatible, w as fingerprintJsonObject, x as codexLegacyDynamicToolsFingerprint, y as areUserMcpServersFingerprintsCompatible } from "./thread-requests-DjyDmCo4.mjs";
+import { i as resolveCodexSessionBinding, o as hashCodexAppServerBindingFingerprint } from "./session-binding-BDnNz-Co.mjs";
 import { i as resolveCodexAppServerThreadModelSelection, n as resolveCodexAppServerModelProvider } from "./thread-model-selection-DcVebr8N.mjs";
-import { c as withExclusiveCodexAppServerThread, r as retainCodexAppServerBindingSubscription, t as isSameCodexAppServerThreadOwner } from "./thread-ownership-BoUd0i6L.mjs";
-import { a as refreshCodexThreadInstructions, i as assertCodexSupervisionThreadLineage, n as CodexThreadPolicyHandoffError, o as refreshCodexThreadPolicy, r as assertAdoptedCodexThreadResumeAllowed, t as CodexIncognitoPolicyChangeError } from "./thread-policy-B3wBRNph.mjs";
-import { t as resumeCodexAppServerThread } from "./thread-resume-D-3bsr1j.mjs";
-import { r as readCodexMcpToolConnectorId } from "./mcp-tool-metadata-DW41snf3.mjs";
-import { n as disableCodexPluginThreadConfig } from "./dynamic-tool-build-DcaPmBlE.mjs";
-import { n as CodexManagedHooksOnlyError, r as assertCodexNativeHookRelayAllowed } from "./native-hook-relay-wq7jrNLk.mjs";
+import { c as withExclusiveCodexAppServerThread, r as retainCodexAppServerBindingSubscription, t as isSameCodexAppServerThreadOwner } from "./thread-ownership-BBsOFzCM.mjs";
+import { a as refreshCodexThreadInstructions, i as assertCodexSupervisionThreadLineage, n as CodexThreadPolicyHandoffError, o as refreshCodexThreadPolicy, r as assertAdoptedCodexThreadResumeAllowed, t as CodexIncognitoPolicyChangeError } from "./thread-policy-BEiS7ITh.mjs";
+import { t as resumeCodexAppServerThread } from "./thread-resume-BqOca2Iy.mjs";
+import { r as readCodexMcpToolConnectorId } from "./mcp-tool-metadata-_sawBkIh.mjs";
+import { n as disableCodexPluginThreadConfig } from "./dynamic-tool-build-DjbDZzOJ.mjs";
+import { n as CodexManagedHooksOnlyError, r as assertCodexNativeHookRelayAllowed } from "./native-hook-relay-BvwSj5bt.mjs";
 import { t as defaultCodexPluginMetadataCache } from "./plugin-metadata-cache-Bi8TAPwX.mjs";
-import { a as discardUnattestedCodexPluginThread, i as checkCodexThreadAppAvailability, n as resolveCodexNativeSkillIsolation, o as hasCodexNativeToolCatalog, r as attestCodexThreadToolSurface, s as loadCodexNativeToolCatalog, t as applyCodexNativeSkillIsolation } from "./native-skill-isolation-DSBeF-Yy.mjs";
+import { a as discardUnattestedCodexPluginThread, i as checkCodexThreadAppAvailability, n as resolveCodexNativeSkillIsolation, o as hasCodexNativeToolCatalog, r as attestCodexThreadToolSurface, s as loadCodexNativeToolCatalog, t as applyCodexNativeSkillIsolation } from "./native-skill-isolation-Cx2AkUco.mjs";
 import { asOptionalRecord, normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
 import crypto from "node:crypto";
 import { isDeepStrictEqual } from "node:util";
 import { resolveSessionAgentIdsStrict } from "openclaw/plugin-sdk/agent-scope-runtime";
 import path from "node:path";
-import { isIncognitoSessionKey } from "openclaw/plugin-sdk/session-key-runtime";
 import { createStageTimingTracker, formatStageTimings, racePromiseWithAbortSignal } from "openclaw/plugin-sdk/time-runtime";
+import { isIncognitoSessionKey } from "openclaw/plugin-sdk/session-key-runtime";
 import { resolveAgentDir as resolveAgentDir$1 } from "openclaw/plugin-sdk/agent-runtime";
 import { AgentHarnessPreflightError, embeddedAgentLog, formatErrorMessage, isActiveHarnessContextEngine, isHostScopedAgentToolActive } from "openclaw/plugin-sdk/agent-harness-runtime";
 import { buildCodexUserMcpServersThreadConfigPatchForRun } from "openclaw/plugin-sdk/codex-mcp-projection";
@@ -825,7 +825,7 @@ async function prepareCodexThreadLifecyclePreflight(params) {
 	if (restrictedToolSurface && params.nativeCodeModeEnabled !== false) throw new Error("Codex restricted tool surfaces require native code mode to be disabled");
 	if (!effectiveConfig) effectiveConfig = await lifecycleTiming.measure("effective-config-read", () => readCodexEffectiveConfig(params.client, params.cwd, { signal: params.signal }));
 	params.config = mergeCodexNativeProjectDocThreadConfig(params.config, effectiveConfig);
-	if (params.shellEnvironment || params.shellGitConfigParameters) params.config = mergeCodexNativeShellEnvironment(params.config, effectiveConfig.config.shell_environment_policy);
+	if (params.shellEnvironment) params.config = mergeCodexNativeShellEnvironment(params.config, effectiveConfig.config.shell_environment_policy);
 	const restrictedToolSurfaceInheritedMcpServerNames = restrictedToolSurface ? await lifecycleTiming.measure("restricted-tool-surface-mcp-policy", () => readCodexInheritedMcpServerNames(params.client, params.cwd, params.signal, effectiveConfig)) : [];
 	if (restrictedToolSurface || imageGenerationDenied || params.nativeCodeModeEnabled !== false) await lifecycleTiming.measure("tool-policy-config-requirements-read", () => assertCodexManagedRequirementsDoNotOverrideToolPolicy(params.client, {
 		restrictedToolSurface,
@@ -1216,7 +1216,10 @@ async function releaseCodexRetainedLiveThread(options) {
 /** Release follows the physical owner across connection rotation, never a copied thread id. */
 async function releaseCodexBoundLiveThread(options) {
 	const changedClient = options.ownerClientId && options.ownerClientId !== options.clientId;
-	const previous = changedClient ? await retainSharedCodexAppServerClientByInstanceId(options.ownerClientId) : void 0;
+	const previous = changedClient ? await retainSharedCodexAppServerClientByInstanceId(options.ownerClientId, {
+		signal: options.signal,
+		createAbortError: codexThreadLifecycleAbortError
+	}) : void 0;
 	if (changedClient && !previous) return false;
 	const client = previous?.client ?? options.client;
 	try {
@@ -1580,6 +1583,16 @@ function observeCodexThreadConfiguration(params, thread, assertCurrent) {
 	};
 }
 //#endregion
+//#region extensions/codex/src/app-server/thread-lifecycle-projection.ts
+/** Projection identity omits persistent instructions: qualify using warm reuse's full policy. */
+async function canRetainCodexProjectionBackgroundWork(params, binding, context, pluginThreadConfig) {
+	const finalConfig = await prepareCodexThreadFinalConfigPatch(params, context.nativeModelInputTools, binding);
+	const pluginConfig = pluginThreadConfig?.configPatch ?? (params.pluginThreadConfig?.enabled && binding.pluginAppPolicyContext ? buildCodexPluginAppsConfigPatchFromPolicyContext(binding.pluginAppPolicyContext) : void 0);
+	const authProfileId = binding.connectionScope === "supervision" ? void 0 : params.params.authProfileId ?? binding.authProfileId;
+	const resumeParams = context.buildResumeParams(binding, authProfileId, buildCodexThreadRequestConfig(params, context, pluginConfig, finalConfig.configPatch));
+	return isCodexAppServerLiveThreadBackgroundOnly(params.client, binding.threadId, fingerprintCodexThreadConfig(resumeParams, authProfileId, context.dynamicToolsFingerprint, binding));
+}
+//#endregion
 //#region extensions/codex/src/app-server/thread-supervision-cleanup.ts
 function withPendingSupervisionCleanup(pending, cleanupThreadIds) {
 	return {
@@ -1917,6 +1930,7 @@ async function startOrResumeThread(input) {
 		const preflight = await prepareCodexThreadLifecyclePreflight(params);
 		const callerConfig = params.config;
 		const { contextEngineBinding, dynamicToolsContainDeferred, dynamicToolsFingerprint, hostSystemAgentActive, legacyDynamicToolsFingerprint, legacyUserMcpServersFingerprint, lifecycleTiming, nativeSkillIsolationFingerprint, networkProxyConfigFingerprint, ringZeroActive, ringZeroClientInstanceId, ringZeroConfigFingerprint, restrictedToolSurface, restrictedToolSurfaceInheritedMcpServerNames, userMcpServersFingerprint, webSearchThreadConfigFingerprint } = preflight;
+		let retainBackgroundPredecessor = false;
 		let replacementPredecessor;
 		const initialBoundThreadId = binding?.threadId;
 		const initialBoundClientId = binding?.clientId;
@@ -2101,21 +2115,6 @@ async function startOrResumeThread(input) {
 			embeddedAgentLog.debug("codex app-server delegation restricted for turn; starting transient thread", { threadId: binding.threadId });
 			binding = void 0;
 		}
-		if (binding?.threadId && (binding.contextEngine || contextEngineBinding)) {
-			if (!contextEngineBinding || !isContextEngineBindingCompatible(binding.contextEngine, contextEngineBinding)) {
-				rotateStaleBinding(binding, "context-engine binding", {
-					engineId: contextEngineBinding?.engineId,
-					previousEngineId: binding.contextEngine?.engineId,
-					epoch: contextEngineBinding?.projection?.epoch,
-					previousEpoch: binding.contextEngine?.projection?.epoch,
-					fingerprint: contextEngineBinding?.projection?.fingerprint,
-					previousFingerprint: binding.contextEngine?.projection?.fingerprint,
-					policyFingerprint: contextEngineBinding?.policyFingerprint,
-					previousPolicyFingerprint: binding.contextEngine?.policyFingerprint
-				});
-				rotatedContextEngineBinding = true;
-			}
-		}
 		if (binding?.threadId) {
 			if (!areUserMcpServersFingerprintsCompatible({
 				previous: binding.userMcpServersFingerprint,
@@ -2132,6 +2131,31 @@ async function startOrResumeThread(input) {
 			})) rotateStaleBinding(binding, "plugin app config");
 			else if (binding.dynamicToolsFingerprint && params.dynamicTools.length > 0 && binding.dynamicToolsContainDeferred !== dynamicToolsContainDeferred && (binding.dynamicToolsContainDeferred !== void 0 || !dynamicToolsContainDeferred)) rotateStaleBinding(binding, "dynamic tool loading");
 		}
+		if (binding?.threadId && (binding.contextEngine || contextEngineBinding)) {
+			if (!contextEngineBinding || !isContextEngineBindingCompatible(binding.contextEngine, contextEngineBinding)) {
+				retainBackgroundPredecessor = initialBoundClientId === clientId && binding.contextEngine?.engineId === contextEngineBinding?.engineId && binding.contextEngine?.policyFingerprint === contextEngineBinding?.policyFingerprint && Boolean(contextEngineBinding) && (!binding.dynamicToolsFingerprint || areCodexDynamicToolFingerprintsCompatible({
+					previous: binding.dynamicToolsFingerprint,
+					next: dynamicToolsFingerprint,
+					nextLegacy: legacyDynamicToolsFingerprint
+				})) && isCodexAppServerLiveThreadBackgroundOnly(params.client, binding.threadId);
+				if (retainBackgroundPredecessor) {
+					const currentPluginConfig = await buildLoadedPluginThreadConfig(binding);
+					if (currentPluginConfig && currentPluginConfig.fingerprint !== binding.pluginAppsFingerprint) retainBackgroundPredecessor = false;
+				}
+				if (retainBackgroundPredecessor) retainBackgroundPredecessor = await canRetainCodexProjectionBackgroundWork(params, binding, await prepareRequestContext(), prebuiltPluginThreadConfig);
+				rotateStaleBinding(binding, "context-engine binding", {
+					engineId: contextEngineBinding?.engineId,
+					previousEngineId: binding.contextEngine?.engineId,
+					epoch: contextEngineBinding?.projection?.epoch,
+					previousEpoch: binding.contextEngine?.projection?.epoch,
+					fingerprint: contextEngineBinding?.projection?.fingerprint,
+					previousFingerprint: binding.contextEngine?.projection?.fingerprint,
+					policyFingerprint: contextEngineBinding?.policyFingerprint,
+					previousPolicyFingerprint: binding.contextEngine?.policyFingerprint
+				});
+				rotatedContextEngineBinding = true;
+			}
+		}
 		if (binding?.threadId) {
 			if (binding.dynamicToolsFingerprint && !areCodexDynamicToolFingerprintsCompatible({
 				previous: binding.dynamicToolsFingerprint,
@@ -2181,7 +2205,7 @@ async function startOrResumeThread(input) {
 		}
 		assertCodexBindingMayBeReplaced(binding, "starting a fresh native thread", expectedOwnership);
 		const requestContext = await prepareRequestContext();
-		if (initialBoundThreadId && !preserveExistingBinding && !configuredMcpOwnershipChanged) await releaseRetainedThread(initialBoundThreadId);
+		if (initialBoundThreadId && !preserveExistingBinding && !configuredMcpOwnershipChanged && !(retainBackgroundPredecessor && isCodexAppServerLiveThreadBackgroundOnly(params.client, initialBoundThreadId))) await releaseRetainedThread(initialBoundThreadId);
 		const started = await startFreshCodexThread(params, {
 			...requestContext,
 			prebuiltPluginThreadConfig,

package/dist/.setup/{thread-ownership-BoUd0i6L.mjs → thread-ownership-BBsOFzCM.mjs}

@@ -1,8 +1,8 @@
-import { S as retainSharedCodexAppServerClientByInstanceId } from "./auth-cache-key-f8ODJ_OX.mjs";
+import { S as retainSharedCodexAppServerClientByInstanceId } from "./auth-cache-key-CXK7tmkb.mjs";
 import { t as withCodexAppServerThreadMutation } from "./thread-ownership-queue-CeyYScUC.mjs";
-import { K as releaseCodexAppServerLiveThread, V as isCodexAppServerLiveThreadClaimed, q as retainCodexAppServerLiveThread } from "./shared-client-BCx1wbyA.mjs";
-import { f as unsubscribeCodexThreadBestEffort, o as closeCodexStartupClientBestEffort, r as CodexAppServerUnsafeSubscriptionError } from "./attempt-client-cleanup-zNuNTKVr.mjs";
-import { t as __exportAll } from "./session-binding-sidecars-DD-enC8w.mjs";
+import { H as isCodexAppServerLiveThreadClaimed, J as retainCodexAppServerLiveThread, q as releaseCodexAppServerLiveThread } from "./shared-client-CNGDTv68.mjs";
+import { f as unsubscribeCodexThreadBestEffort, o as closeCodexStartupClientBestEffort, r as CodexAppServerUnsafeSubscriptionError } from "./attempt-client-cleanup-BVww-ct8.mjs";
+import { t as __exportAll } from "./session-binding-sidecars-DijNZb31.mjs";
 import { createDeferred } from "openclaw/plugin-sdk/extension-shared";
 import { runWithAsyncWorkResources } from "openclaw/plugin-sdk/agent-harness-tool-runtime";
 //#region extensions/codex/src/app-server/thread-ownership.ts

package/dist/.setup/{thread-policy-B3wBRNph.mjs → thread-policy-BEiS7ITh.mjs}

@@ -1,7 +1,7 @@
 import { i as CodexAppServerScopedRequestRejectedError, o as isCodexAppServerOverloadError } from "./rpc-error-C98SHchT.mjs";
-import { n as requestCodexAppServerClientJson } from "./request-Bo0kKABI.mjs";
-import { S as CodexAdoptedThreadActiveError } from "./shared-client-BCx1wbyA.mjs";
-import { p as assertCodexThreadAcceptsDirectInput, s as isCodexAppServerPrewriteRequestCancellationError } from "./client-D93nbdB8.mjs";
+import { n as requestCodexAppServerClientJson } from "./request-m-H-7FMu.mjs";
+import { S as CodexAdoptedThreadActiveError } from "./shared-client-CNGDTv68.mjs";
+import { p as assertCodexThreadAcceptsDirectInput, s as isCodexAppServerPrewriteRequestCancellationError } from "./client-Div-zqnz.mjs";
 import { AgentHarnessPreflightError, embeddedAgentLog, formatErrorMessage } from "openclaw/plugin-sdk/agent-harness-runtime";
 //#region extensions/codex/src/app-server/thread-policy.ts
 /** A refusal, not a failed native write: the ephemeral conversation must stay alive. */

package/dist/.setup/{thread-requests-BgzJwJtS.mjs → thread-requests-DjyDmCo4.mjs}

@@ -1,13 +1,11 @@
 import { i as isJsonObject } from "./protocol-CANUwXJ3.mjs";
-import { t as appendCodexGitConfigParameters } from "./config-utils-DN_YT7dE.mjs";
-import { d as readCodexEffectiveConfig, u as CODEX_SESSION_OVERRIDABLE_LAYER_TYPES } from "./config-options-DDzeNQ8m.mjs";
+import { d as readCodexEffectiveConfig, u as CODEX_SESSION_OVERRIDABLE_LAYER_TYPES } from "./config-options-CZmH25Xq.mjs";
 import { a as isCodexResponsesOAuthRun } from "./responses-oauth-twnuTaAa.mjs";
-import { d as mergeCodexThreadConfigs, t as buildCodexProjectDocThreadConfig } from "./project-doc-thread-config-BVcvnps8.mjs";
-import { o as hashCodexAppServerBindingFingerprint } from "./session-binding-JEHNMPsr.mjs";
+import { d as mergeCodexThreadConfigs, t as buildCodexProjectDocThreadConfig } from "./project-doc-thread-config-D_sWbxFR.mjs";
+import { o as hashCodexAppServerBindingFingerprint } from "./session-binding-BDnNz-Co.mjs";
 import { n as resolveCodexAppServerModelProvider, r as resolveCodexAppServerRequestModelSelection, t as CODEX_NATIVE_PERSONALITY_NONE } from "./thread-model-selection-DcVebr8N.mjs";
 import { normalizeOptionalString, normalizeUniqueStringEntries, normalizeUniqueTrimmedStringList } from "openclaw/plugin-sdk/string-coerce-runtime";
-import * as crypto$1 from "node:crypto";
-import crypto from "node:crypto";
+import crypto, * as crypto$1 from "node:crypto";
 import path from "node:path";
 import { isIncognitoSessionKey } from "openclaw/plugin-sdk/session-key-runtime";
 import { expectDefined } from "openclaw/plugin-sdk/expect-runtime";
@@ -278,41 +276,20 @@ function buildDeveloperInstructions(params, options = {}) {
 }
 //#endregion
 //#region extensions/codex/src/app-server/thread-shell-environment.ts
-const GIT_CONFIG_PARAMETERS = "GIT_CONFIG_PARAMETERS";
-function matchesGitConfigParameters(pattern) {
-	const escaped = pattern.replace(/[.+^${}()|[\]\\]/gu, "\\$&");
-	return new RegExp(`^${escaped.replaceAll("*", ".*").replaceAll("?", ".")}$`, "iu").test(GIT_CONFIG_PARAMETERS);
-}
 /** Retain native policy beneath request overrides before applying host-owned values. */
 function mergeCodexNativeShellEnvironment(config, nativePolicy) {
 	return isJsonObject(nativePolicy) ? mergeCodexThreadConfigs({ shell_environment_policy: Object.fromEntries(Object.entries(nativePolicy).filter(([, value]) => value !== null)) }, config) : config;
 }
 /** Applies host-selected values and any required login-shell restriction last. */
-function applyCodexManagedShellEnvironment(config, environment, disableLoginShell = false, pathPrepend, gitConfigParameters) {
-	const hasEnvironment = environment !== void 0 && Object.keys(environment).length > 0;
-	if (!hasEnvironment && !gitConfigParameters) return disableLoginShell ? {
+function applyCodexManagedShellEnvironment(config, environment, disableLoginShell = false, pathPrepend) {
+	if (!environment || Object.keys(environment).length === 0) return disableLoginShell ? {
 		...config,
 		allow_login_shell: false
 	} : config;
 	const current = isJsonObject(config.shell_environment_policy) ? config.shell_environment_policy : {};
 	const currentSet = isJsonObject(current.set) ? current.set : {};
 	const managedEnvironment = { ...environment };
-	const includeOnly = Array.isArray(current.include_only) ? current.include_only.filter((entry) => typeof entry === "string") : [];
-	const filters = isJsonObject(current.filters) ? current.filters : void 0;
-	if (gitConfigParameters) {
-		const include = filters ? Object.keys(filters).filter((pattern) => filters[pattern] === "include") : includeOnly;
-		const exclude = filters ? Object.keys(filters).filter((pattern) => filters[pattern] === "exclude") : Array.isArray(current.exclude) ? current.exclude.filter((entry) => typeof entry === "string") : [];
-		const aliases = Object.keys(currentSet).filter((key) => key === GIT_CONFIG_PARAMETERS || process.platform === "win32" && key.toUpperCase() === GIT_CONFIG_PARAMETERS);
-		const authoredKey = aliases.includes(GIT_CONFIG_PARAMETERS) ? GIT_CONFIG_PARAMETERS : aliases[0];
-		const includesParameters = include.length === 0 || include.some(matchesGitConfigParameters);
-		const inheritsParameters = current.inherit !== "none" && current.inherit !== "core" && !exclude.some(matchesGitConfigParameters) && includesParameters;
-		if (authoredKey !== void 0 || !inheritsParameters) {
-			const base = authoredKey !== void 0 && includesParameters ? currentSet[authoredKey] : void 0;
-			const composed = appendCodexGitConfigParameters(typeof base === "string" ? base : void 0, gitConfigParameters);
-			for (const name of [GIT_CONFIG_PARAMETERS, ...aliases]) managedEnvironment[name] = composed;
-		}
-	}
-	if (pathPrepend?.length) for (const key of Object.keys(environment ?? {})) {
+	if (pathPrepend?.length) for (const key of Object.keys(environment)) {
 		if (key.toUpperCase() !== "PATH") continue;
 		const aliases = Object.keys(currentSet).filter((name) => name === key || process.platform === "win32" && name.toUpperCase() === "PATH");
 		const authoredKey = aliases.includes(key) ? key : aliases[0];
@@ -322,13 +299,15 @@ function applyCodexManagedShellEnvironment(config, environment, disableLoginShel
 		}
 	}
 	const names = Object.keys(managedEnvironment).toSorted();
+	const includeOnly = Array.isArray(current.include_only) ? current.include_only.filter((entry) => typeof entry === "string") : [];
+	const filters = isJsonObject(current.filters) ? current.filters : void 0;
 	const hasIncludeFilter = filters && Object.values(filters).includes("include");
 	const managedFilterNames = new Set(names.map((name) => name.toLowerCase()));
 	const managedConfig = {
 		...config,
 		shell_environment_policy: {
 			...current,
-			...hasEnvironment ? { experimental_use_profile: false } : {},
+			experimental_use_profile: false,
 			set: {
 				...currentSet,
 				...managedEnvironment
@@ -635,7 +614,7 @@ function buildCodexRuntimeThreadConfigForRun(params, config, options = {}) {
 			"skills.bundled.enabled": false
 		} : void 0, params.pluginHarnessToolPolicySafeDeniedTools?.includes("image_generate") ? { "features.image_generation": false } : void 0, shouldDisableCodexToolSearchForModel(params.modelId) ? { "features.multi_agent": false } : void 0, messageOnlySourceReply || params.pluginHarnessToolPolicyRestricted === true || params.requireWorkspaceOnly === true ? buildRestrictedToolConfigPatch(restrictedToolSurfaceMcpServerNames, Boolean(params.scheduledRuntimeAuthority) && !isCodexResponsesOAuthRun(params) && params.requireWorkspaceOnly !== true) : buildCodexRingZeroThreadConfigPatch(params, options.hostSystemAgentActive, restrictedToolSurfaceMcpServerNames), restrictedTurnDisablesProjectDocs ? CODEX_NO_PROJECT_DOCS_CONFIG : void 0, params.authoredContextTokenCap === void 0 ? void 0 : { model_context_window: params.authoredContextTokenCap }) ?? baseConfig,
 		...params.bootstrapContextMode === "lightweight" ? CODEX_NO_PROJECT_DOCS_CONFIG : {}
-	}, options.shellEnvironment, options.disableLoginShell, options.shellPathPrepend, options.shellGitConfigParameters);
+	}, options.shellEnvironment, options.disableLoginShell, options.shellPathPrepend);
 }
 function buildCodexRingZeroThreadConfigPatch(params, hostSystemAgentActive = isHostScopedAgentToolActive("openclaw"), inheritedMcpServerNames = []) {
 	if (!hostSystemAgentActive || !isSystemAgentOnlyCodexDynamicToolAllowlist(params.toolsAllow)) return;

package/dist/.setup/{thread-resume-D-3bsr1j.mjs → thread-resume-BqOca2Iy.mjs}

@@ -1,8 +1,8 @@
 import { i as CodexAppServerScopedRequestRejectedError, o as isCodexAppServerOverloadError, r as CodexAppServerRpcError } from "./rpc-error-C98SHchT.mjs";
-import { r as publishCodexCatalogResume } from "./session-catalog-events-kR2Ot6nX.mjs";
-import { L as forgetCodexWorkspaceReferences, pt as isCodexAppServerStartupError, u as isCodexAppServerStartSelectionChangedError } from "./shared-client-BCx1wbyA.mjs";
-import { h as assertCodexThreadResumeResponse, s as isCodexAppServerPrewriteRequestCancellationError } from "./client-D93nbdB8.mjs";
-import { f as unsubscribeCodexThreadBestEffort, i as assertCodexThreadResumeSubscription, r as CodexAppServerUnsafeSubscriptionError } from "./attempt-client-cleanup-zNuNTKVr.mjs";
+import { r as publishCodexCatalogResume } from "./session-catalog-events-BBV3DMG7.mjs";
+import { L as forgetCodexWorkspaceReferences, mt as isCodexAppServerStartupError, u as isCodexAppServerStartSelectionChangedError } from "./shared-client-CNGDTv68.mjs";
+import { h as assertCodexThreadResumeResponse, s as isCodexAppServerPrewriteRequestCancellationError } from "./client-Div-zqnz.mjs";
+import { f as unsubscribeCodexThreadBestEffort, i as assertCodexThreadResumeSubscription, r as CodexAppServerUnsafeSubscriptionError } from "./attempt-client-cleanup-BVww-ct8.mjs";
 import { sanitizeTerminalText } from "openclaw/plugin-sdk/text-chunking";
 //#region extensions/codex/src/app-server/thread-resume.ts
 /** Owns Codex thread/resume subscription safety. */

package/dist/.setup/{transcript-mirror-Bee2o6jj.mjs → transcript-mirror-DVEzdOs0.mjs}

@@ -2,7 +2,7 @@ import { t as readCodexAsyncQuestions } from "./async-questions-DdhOCwGi.mjs";
 import { a as readUpstreamUserText, i as readMirrorIdentity, n as attachCodexMirrorIdentity, o as takeCodexAssistantItemIds, r as attachUpstreamUserText } from "./upstream-prompt-provenance-Ccd9MFRJ.mjs";
 import { t as projectBoundedCodexThreadHistory } from "./transcript-history-projection-DfKcoZCB.mjs";
 import { a as buildCodexMirrorIdempotencyKey, c as isMirroredAgentMessage, i as buildCodexMirrorDedupeIdentity, l as readCodexMirrorSourceFingerprint, n as attachCodexMirrorAttestation, o as fingerprintCodexMirrorSourceMessage, r as attachCodexMirrorRunId, t as applyCodexTranscriptTaint } from "./transcript-mirror-attestation-BzUXnrvv.mjs";
-import { t as __exportAll } from "./session-binding-sidecars-DD-enC8w.mjs";
+import { t as __exportAll } from "./session-binding-sidecars-DijNZb31.mjs";
 import { normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { deliverAgentHarnessUserInputPrompt, embeddedAgentLog, formatErrorMessage, projectAgentHarnessTranscriptMessageForDisplay, restorePreparedUserTurnOperationalMetaForRuntime, runAgentHarnessBeforeMessageWriteHook } from "openclaw/plugin-sdk/agent-harness-runtime";
 import { withCodexSessionTranscriptMirrorWrite } from "openclaw/plugin-sdk/codex-session-transcript-runtime";

package/dist/.setup/{transport-stdio-CRWTkKOn.mjs → transport-stdio-lgeKKHyw.mjs}

@@ -1,6 +1,5 @@
-import { t as appendCodexGitConfigParameters } from "./config-utils-DN_YT7dE.mjs";
 import { r as normalizeCodexAppServerArgs } from "./launch-args-DbFCehO7.mjs";
-import { i as resolveManagedCodexNativeCommand } from "./managed-binary-BtIjV7yN.mjs";
+import { i as resolveManagedCodexNativeCommand } from "./managed-binary-DwC9wxch.mjs";
 import { i as recordCodexAppServerSpawnFailure, r as getCodexAppServerSpawnFailure } from "./spawn-error-CL3n6MAa.mjs";
 import { createHash, randomUUID } from "node:crypto";
 import { stripVTControlCharacters } from "node:util";
@@ -864,20 +863,6 @@ function resolveCodexAppServerSpawnEnv(options, baseEnv = process.env, platform
 	}
 	return env;
 }
-/** Keep inherited Git settings in the private process environment, outside thread config. */
-function withCodexAppServerGitConfig(options, parameters) {
-	const env = resolveCodexAppServerSpawnEnv(options);
-	const key = process.platform === "win32" ? Object.keys(env).toSorted().find((name) => name.toUpperCase() === "GIT_CONFIG_PARAMETERS") : "GIT_CONFIG_PARAMETERS";
-	const inherited = key === void 0 ? void 0 : env[key];
-	return {
-		...options,
-		env: {
-			...options.env,
-			GIT_CONFIG_PARAMETERS: appendCodexGitConfigParameters(inherited, parameters)
-		},
-		...options.clearEnv ? { clearEnv: options.clearEnv.filter((name) => (process.platform === "win32" ? name.trim().toUpperCase() : name.trim()) !== "GIT_CONFIG_PARAMETERS") } : {}
-	};
-}
 /** Spawns the Codex app-server process and returns the shared transport interface. */
 async function createStdioTransport(options, baseEnv = process.env, assertCurrent, onSpawn) {
 	const isHostedGateway = baseEnv.OPENCLAW_GATEWAY_HOST_LIFELINE?.trim() === "stdin";
@@ -932,4 +917,4 @@ async function createStdioTransport(options, baseEnv = process.env, assertCurren
 	}
 }
 //#endregion
-export { closeCodexAppServerTransport as a, createCodexAppServerProcessReaperService as c, withCodexAppServerGitConfig as i, getCodexAppServerRegisteredTransportIdentity as l, resolveCodexAppServerSpawnEnv as n, closeCodexAppServerTransportAndWait as o, resolveCodexAppServerSpawnInvocation as r, hasCodexAppServerNaturalExit as s, createStdioTransport as t };
+export { closeCodexAppServerTransportAndWait as a, getCodexAppServerRegisteredTransportIdentity as c, closeCodexAppServerTransport as i, resolveCodexAppServerSpawnEnv as n, hasCodexAppServerNaturalExit as o, resolveCodexAppServerSpawnInvocation as r, createCodexAppServerProcessReaperService as s, createStdioTransport as t };

package/dist/.setup/{transport-websocket-DIyPfkHo.mjs → transport-websocket-CEBjEtFP.mjs}

@@ -1,5 +1,5 @@
 import { r as resolveCodexAppServerUserHomeDir } from "./auth-start-options-BPIPeEX8.mjs";
-import "./config-C1YVVLEA.mjs";
+import "./config-LQemoqTL.mjs";
 import { t as codexWebSocketDataToBuffer } from "./websocket-data-XlRvt8Ys.mjs";
 import path from "node:path";
 import { EventEmitter } from "node:events";

package/dist/.setup/{turn-router-DBVMToGo.mjs → turn-router-DM0fRrYI.mjs}

@@ -1,6 +1,6 @@
 import { i as isJsonObject } from "./protocol-CANUwXJ3.mjs";
 import { n as waitForPromiseOrAbort, t as abortReason } from "./timeout-D0mEWSGG.mjs";
-import { x as readCodexTurnCompletedNotification } from "./client-D93nbdB8.mjs";
+import { x as readCodexTurnCompletedNotification } from "./client-Div-zqnz.mjs";
 import { normalizeOptionalString, readStringField } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { AsyncResource } from "node:async_hooks";
 import { createDeferred } from "openclaw/plugin-sdk/extension-shared";

package/dist/.setup/{upstream-session-fork-p5fwKi7w.mjs → upstream-session-fork-CxgShpwe.mjs}

@@ -1,7 +1,7 @@
 import { i as isJsonObject, r as flattenCodexDynamicToolFunctions } from "./protocol-CANUwXJ3.mjs";
-import { m as sessionBindingIdentity } from "./session-binding-record-DU_0biMD.mjs";
-import { d as readCodexPluginConfig } from "./config-parsing-DsWSCPHO.mjs";
-import { s as assertCodexModelBackedReviewerEffectiveConfig } from "./config-options-DDzeNQ8m.mjs";
+import { m as sessionBindingIdentity } from "./session-binding-record-C2kDBZhx.mjs";
+import { d as readCodexPluginConfig } from "./config-parsing-CVK2Q463.mjs";
+import { s as assertCodexModelBackedReviewerEffectiveConfig } from "./config-options-CZmH25Xq.mjs";
 import { t as withCodexAppServerThreadMutation } from "./thread-ownership-queue-CeyYScUC.mjs";
 import { i as CodexAppServerScopedRequestRejectedError, o as isCodexAppServerOverloadError } from "./rpc-error-C98SHchT.mjs";
 import { a as readUpstreamUserText, i as readMirrorIdentity } from "./upstream-prompt-provenance-Ccd9MFRJ.mjs";
@@ -9,24 +9,24 @@ import { r as projectCodexUserItemText } from "./transcript-history-projection-D
 import { n as codexUpstreamBaseline, t as codexLastTerminalTurnId } from "./session-upstream-marker-D15C9NHp.mjs";
 import { r as buildCodexPluginAppCacheKey } from "./plugin-app-cache-key-Bg9DbDI6.mjs";
 import { n as readCodexSessionMeta } from "./session-catalog-provenance-CmsOE5mh.mjs";
-import "./request-Bo0kKABI.mjs";
-import { r as resolveOpenClawExecPolicyForCodexAppServer } from "./config-C1YVVLEA.mjs";
-import { r as resolveCodexSupervisionAppServerRuntimeOptions } from "./config-runtime-DWzK-k0n.mjs";
+import "./request-m-H-7FMu.mjs";
+import { r as resolveOpenClawExecPolicyForCodexAppServer } from "./config-LQemoqTL.mjs";
+import { r as resolveCodexSupervisionAppServerRuntimeOptions } from "./config-runtime-DGB1-VbB.mjs";
 import { l as readCodexMirrorSourceFingerprint, o as fingerprintCodexMirrorSourceMessage } from "./transcript-mirror-attestation-BzUXnrvv.mjs";
-import { P as claimCodexAppServerLiveThread, R as hasCodexAppServerLiveThread, f as readCodexAppServerClientDesktopGenerationFingerprint } from "./shared-client-BCx1wbyA.mjs";
-import { m as assertCodexThreadForkResponse, p as assertCodexThreadAcceptsDirectInput, s as isCodexAppServerPrewriteRequestCancellationError } from "./client-D93nbdB8.mjs";
-import { d as mergeCodexThreadConfigs, i as buildCodexPluginThreadConfig, p as shouldBuildCodexPluginThreadConfig } from "./project-doc-thread-config-BVcvnps8.mjs";
-import { T as fingerprintUserMcpServersConfigPatch, _ as buildDeveloperInstructions, a as buildCodexThreadConfiguration, b as codexDynamicToolsFingerprint, h as resolveCodexWebSearchPlan, w as fingerprintJsonObject } from "./thread-requests-BgzJwJtS.mjs";
-import "./session-binding-JEHNMPsr.mjs";
-import "./thread-ownership-BoUd0i6L.mjs";
+import { P as claimCodexAppServerLiveThread, R as hasCodexAppServerLiveThread, f as readCodexAppServerClientDesktopGenerationFingerprint } from "./shared-client-CNGDTv68.mjs";
+import { m as assertCodexThreadForkResponse, p as assertCodexThreadAcceptsDirectInput, s as isCodexAppServerPrewriteRequestCancellationError } from "./client-Div-zqnz.mjs";
+import { d as mergeCodexThreadConfigs, i as buildCodexPluginThreadConfig, p as shouldBuildCodexPluginThreadConfig } from "./project-doc-thread-config-D_sWbxFR.mjs";
+import { T as fingerprintUserMcpServersConfigPatch, _ as buildDeveloperInstructions, a as buildCodexThreadConfiguration, b as codexDynamicToolsFingerprint, h as resolveCodexWebSearchPlan, w as fingerprintJsonObject } from "./thread-requests-DjyDmCo4.mjs";
+import "./session-binding-BDnNz-Co.mjs";
+import "./thread-ownership-BBsOFzCM.mjs";
 import { n as resolveCodexNativeExecutionPolicy } from "./native-execution-policy-MXEe7PB3.mjs";
-import { n as CodexThreadPolicyHandoffError, o as refreshCodexThreadPolicy } from "./thread-policy-B3wBRNph.mjs";
-import { b as isCodexDynamicToolExcluded, f as codexNativeHookRemoteCredentialPath, i as buildCodexNativeHookRelayConfig, l as resolveCodexNativeHookRelayEvents, o as buildCodexNativeHookRelayId, r as assertCodexNativeHookRelayAllowed } from "./native-hook-relay-wq7jrNLk.mjs";
-import { c as parseCodexNativeToolCatalog, i as checkCodexThreadAppAvailability, n as resolveCodexNativeSkillIsolation, t as applyCodexNativeSkillIsolation } from "./native-skill-isolation-DSBeF-Yy.mjs";
-import { c as prepareCodexWorkspaceDeveloperInstructions } from "./attempt-workspace-context-CcwP3DA3.mjs";
-import { n as resolveCodexProviderWebSearchSupportForClient } from "./provider-capabilities-Dn2WwH4P.mjs";
-import { n as prepareCodexSessionInitialization } from "./session-initialization-Bi_2DKhc.mjs";
-import { createImportedCodexSession } from "./session-history-import-CaO8s6ta.mjs";
+import { n as CodexThreadPolicyHandoffError, o as refreshCodexThreadPolicy } from "./thread-policy-BEiS7ITh.mjs";
+import { b as isCodexDynamicToolExcluded, f as codexNativeHookRemoteCredentialPath, i as buildCodexNativeHookRelayConfig, l as resolveCodexNativeHookRelayEvents, o as buildCodexNativeHookRelayId, r as assertCodexNativeHookRelayAllowed } from "./native-hook-relay-BvwSj5bt.mjs";
+import { c as parseCodexNativeToolCatalog, i as checkCodexThreadAppAvailability, n as resolveCodexNativeSkillIsolation, t as applyCodexNativeSkillIsolation } from "./native-skill-isolation-Cx2AkUco.mjs";
+import { c as prepareCodexWorkspaceDeveloperInstructions } from "./attempt-workspace-context-BkA0W8Jy.mjs";
+import { n as resolveCodexProviderWebSearchSupportForClient } from "./provider-capabilities-B-pTlDsf.mjs";
+import { n as prepareCodexSessionInitialization } from "./session-initialization-BjVtsTzi.mjs";
+import { createImportedCodexSession } from "./session-history-import-DgwRu2eD.mjs";
 import { isRecord, normalizeOptionalString, readNonBlankString } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { randomUUID } from "node:crypto";
 import { isDeepStrictEqual } from "node:util";

package/dist/.setup/{usage-C2Kq7oej.mjs → usage-DV8T9Yau.mjs}

@@ -1,7 +1,7 @@
 import { t as buildCodexAppServerUsageSnapshot } from "./rate-limits-CI8pTPqL.mjs";
-import { t as readCodexAppServerUsage } from "./request-Bo0kKABI.mjs";
-import "./config-C1YVVLEA.mjs";
-import { n as resolveCodexAppServerRuntimeOptions } from "./config-runtime-DWzK-k0n.mjs";
+import { t as readCodexAppServerUsage } from "./request-m-H-7FMu.mjs";
+import "./config-LQemoqTL.mjs";
+import { n as resolveCodexAppServerRuntimeOptions } from "./config-runtime-DGB1-VbB.mjs";
 import { CODEX_APP_SERVER_AUTH_MARKER } from "openclaw/plugin-sdk/agent-runtime";
 //#region extensions/codex/src/app-server/usage.ts
 /** Handles the synthetic usage credential for a Codex-backed OpenAI route. */

package/dist/.setup/{usage-limit-error-BQX8RHAd.mjs → usage-limit-error-ryR1PGou.mjs}

@@ -1,7 +1,7 @@
 import { i as isJsonObject } from "./protocol-CANUwXJ3.mjs";
 import { a as shouldRefreshCodexRateLimitsForUsageLimitMessage, i as resolveCodexUsageLimitResetAtMs, n as formatCodexUsageLimitErrorMessage } from "./rate-limits-CI8pTPqL.mjs";
 import { t as CODEX_CONTROL_METHODS } from "./capabilities-DbOzOglY.mjs";
-import { Q as rememberCodexRateLimitsRead, X as readCodexRateLimitsRevision, Z as readRecentCodexRateLimits } from "./shared-client-BCx1wbyA.mjs";
+import { $ as rememberCodexRateLimitsRead, Q as readRecentCodexRateLimits, Z as readCodexRateLimitsRevision } from "./shared-client-CNGDTv68.mjs";
 import { readStringField } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { markAuthProfileBlockedUntil } from "openclaw/plugin-sdk/agent-runtime";
 import { embeddedAgentLog, formatErrorMessage } from "openclaw/plugin-sdk/agent-harness-runtime";

package/dist/.setup/{web-search-provider.runtime-D89djc7e.mjs → web-search-provider.runtime-DkciK2gS.mjs}

@@ -1,5 +1,5 @@
-import { m as buildCodexNativeWebSearchThreadConfig } from "./thread-requests-BgzJwJtS.mjs";
-import { runBoundedCodexAppServerTurn } from "./bounded-turn-DfIJtRlv.mjs";
+import { m as buildCodexNativeWebSearchThreadConfig } from "./thread-requests-DjyDmCo4.mjs";
+import { runBoundedCodexAppServerTurn } from "./bounded-turn-vdpL2efh.mjs";
 import { t as projectCodexWebSearchItem } from "./web-search-item-CvokaZOo.mjs";
 import { readStringParam, resolveSearchTimeoutSeconds, wrapWebContent } from "openclaw/plugin-sdk/provider-web-search";
 //#region extensions/codex/src/web-search-provider.runtime.ts

package/dist/.setup/{workspace-write-sandbox-probe-BDWO2Qkh.mjs → workspace-write-sandbox-probe-DvfWTvuR.mjs}

@@ -1,6 +1,6 @@
 import { a as resolveCodexPrivateLauncher, n as isCodexAppServerProxyLaunch } from "./launch-args-DbFCehO7.mjs";
-import { n as resolveCodexAppServerSpawnEnv, r as resolveCodexAppServerSpawnInvocation } from "./transport-stdio-CRWTkKOn.mjs";
-import { t as resolveCodexDoctorStartOptions } from "./doctor-start-options-JjTAl-q_.mjs";
+import { n as resolveCodexAppServerSpawnEnv, r as resolveCodexAppServerSpawnInvocation } from "./transport-stdio-lgeKKHyw.mjs";
+import { t as resolveCodexDoctorStartOptions } from "./doctor-start-options-C28ek2hD.mjs";
 import { runUtf8CommandWithTimeout } from "openclaw/plugin-sdk/process-runtime";
 import path from "node:path";
 import fs from "node:fs/promises";

package/dist/api.js

@@ -1,7 +1,7 @@
-import { i as resolveManagedCodexNativeCommand, s as CODEX_APP_SERVER_VERSION } from "./.setup/managed-binary-BtIjV7yN.mjs";
-import { t as codexNativeProfileRecoveryHealthCheck } from "./.setup/auth-profile-health-oHizqgye.mjs";
+import { i as resolveManagedCodexNativeCommand, s as CODEX_APP_SERVER_VERSION } from "./.setup/managed-binary-DwC9wxch.mjs";
+import { t as codexNativeProfileRecoveryHealthCheck } from "./.setup/auth-profile-health-B05o5BAm.mjs";
 import { n as findCodexAppServerSpawnError, t as describeCodexSpawnError } from "./.setup/spawn-error-CL3n6MAa.mjs";
-import { t as resolveCodexDoctorStartOptions } from "./.setup/doctor-start-options-JjTAl-q_.mjs";
+import { t as resolveCodexDoctorStartOptions } from "./.setup/doctor-start-options-C28ek2hD.mjs";
 import { runUtf8CommandWithTimeout } from "openclaw/plugin-sdk/process-runtime";
 import path from "node:path";
 import { coerceErrorMessage } from "openclaw/plugin-sdk/error-runtime";
@@ -115,7 +115,7 @@ function registerCodexManagedAppServerDoctorChecks$1(host, deps) {
 const CODEX_PLUGIN_ROOT = path.dirname(fileURLToPath(import.meta.url));
 async function probeCodexWorkspaceWriteSandbox(params) {
 	try {
-		const { probeCodexWorkspaceWriteSandbox: probe } = await import("./.setup/workspace-write-sandbox-probe-BDWO2Qkh.mjs");
+		const { probeCodexWorkspaceWriteSandbox: probe } = await import("./.setup/workspace-write-sandbox-probe-DvfWTvuR.mjs");
 		return await probe({
 			...params,
 			pluginRoot: CODEX_PLUGIN_ROOT

package/dist/catalog-page.worker.js

@@ -1,4 +1,4 @@
-import { t as createCodexCatalogDecoder } from "./.setup/client-catalog-response-CuVLp4I0.mjs";
+import { t as createCodexCatalogDecoder } from "./.setup/client-catalog-response-Dtob_lVt.mjs";
 import { serveWorkerTasks } from "openclaw/plugin-sdk/worker-task-server";
 //#region extensions/codex/catalog-page.worker.ts
 const decode = createCodexCatalogDecoder();

package/dist/cli-metadata.js

@@ -2,7 +2,7 @@ import { definePluginEntry } from "openclaw/plugin-sdk/plugin-entry";
 //#region extensions/codex/cli-metadata.ts
 function registerCodexCliMetadata(api) {
 	api.registerCli(async ({ program }) => {
-		const { registerCodexSessionCli } = await import("./.setup/session-cli-GwU0izn-.mjs");
+		const { registerCodexSessionCli } = await import("./.setup/session-cli-BoJSZfGd.mjs");
 		registerCodexSessionCli(program);
 	}, { descriptors: [{
 		name: "codex",

package/dist/doctor-contract-api.js

@@ -248,15 +248,15 @@ const stateMigrations = [
 	{
 		id: "codex-app-server-sidecars-to-plugin-state",
 		label: "Codex app-server thread bindings",
-		detectLegacyState: async (params) => (await import("./.setup/session-binding-sidecars-DD-enC8w.mjs")).detectLegacySessionBindingSidecars(params),
-		migrateLegacyState: async (params) => (await import("./.setup/session-binding-sidecars-DD-enC8w.mjs")).migrateLegacySessionBindingSidecars(params)
+		detectLegacyState: async (params) => (await import("./.setup/session-binding-sidecars-DijNZb31.mjs")).detectLegacySessionBindingSidecars(params),
+		migrateLegacyState: async (params) => (await import("./.setup/session-binding-sidecars-DijNZb31.mjs")).migrateLegacySessionBindingSidecars(params)
 	},
 	{
 		id: "codex-native-task-assignments",
 		label: "Codex native pending assignments",
-		collectBackupResources: async (params) => (await import("./.setup/native-task-assignments-DimsQ9Qa.mjs")).codexNativeTaskAssignmentMigration.collectBackupResources(params),
-		detectLegacyState: async (params) => (await import("./.setup/native-task-assignments-DimsQ9Qa.mjs")).codexNativeTaskAssignmentMigration.detectLegacyState(params),
-		migrateLegacyState: async (params) => (await import("./.setup/native-task-assignments-DimsQ9Qa.mjs")).codexNativeTaskAssignmentMigration.migrateLegacyState(params)
+		collectBackupResources: async (params) => (await import("./.setup/native-task-assignments-DYL9uxNe.mjs")).codexNativeTaskAssignmentMigration.collectBackupResources(params),
+		detectLegacyState: async (params) => (await import("./.setup/native-task-assignments-DYL9uxNe.mjs")).codexNativeTaskAssignmentMigration.detectLegacyState(params),
+		migrateLegacyState: async (params) => (await import("./.setup/native-task-assignments-DYL9uxNe.mjs")).codexNativeTaskAssignmentMigration.migrateLegacyState(params)
 	},
 	codexOrphanedSessionBindingMigration
 ];