@openclaw/codex 2026.10.5 → 2026.10.6

package/dist/.setup/{shared-client-wb1JBldZ.mjs → shared-client-CNGDTv68.mjs}

@@ -1,22 +1,22 @@
 import { i as isJsonObject } from "./protocol-CANUwXJ3.mjs";
-import { n as defineCodexBuildState, t as codexBuildSymbol } from "./build-state-DfrctLQv.mjs";
+import { n as defineCodexBuildState, t as codexBuildSymbol } from "./build-state-DPMC9C_U.mjs";
 import { t as CODEX_APP_SERVER_AUTH_PROVIDER } from "./auth-profile-selection-hr8ocLtz.mjs";
 import { n as isCodexAppServerProxyLaunch } from "./launch-args-DbFCehO7.mjs";
 import { a as withEphemeralCodexAuthStore, i as withClearedEnvironmentVariables, n as resolveCodexAppServerLocalHomeDir, r as resolveCodexAppServerUserHomeDir, t as resolveCodexAppServerHomeDir } from "./auth-start-options-BPIPeEX8.mjs";
-import { a as resolveCodexAppServerStartOptionsForAgent, d as readCodexEffectiveConfig, o as resolveCodexComputerUseConfig, t as codexAppServerStartOptionsKey, u as CODEX_SESSION_OVERRIDABLE_LAYER_TYPES } from "./config-options-nvYwVDyy.mjs";
+import { a as resolveCodexAppServerStartOptionsForAgent, d as readCodexEffectiveConfig, o as resolveCodexComputerUseConfig, t as codexAppServerStartOptionsKey, u as CODEX_SESSION_OVERRIDABLE_LAYER_TYPES } from "./config-options-CZmH25Xq.mjs";
 import { d as resolveMacOSDesktopCodexBundledMarketplaceCandidates, f as resolveMacOSDesktopCodexComputerUseServiceAppCandidates, i as resolveManagedCodexNativeCommand, l as resolveFirstExistingMacOSDesktopCodexBundledMarketplacePath, r as resolveManagedCodexAppServerStartOptions, t as isManagedCodexDesktopCommand, u as resolveMacOSDesktopCodexAppPathCandidates } from "./managed-binary-DwC9wxch.mjs";
-import { A as waitForCodexDesktopGeneration, C as retirePendingSharedClientEntryIfUnclaimed, D as waitForUnclaimedSharedClientStartup, _ as observeSharedClientAcquire, a as readCodexCliAuthFileApiKey, b as releaseSharedClientEntry, c as resolveCodexAppServerPreparedApiKeyCacheKey, d as getCurrentSharedClientEntry, f as getOrCreateSharedClientEntry, g as observeAcquire, h as notifyDesktopGenerationDrainChecks, i as fingerprintTokenAuthProfileCacheKey, j as readCodexDesktopArtifactTreeFingerprint, k as isCodexDesktopGenerationCurrent, l as closeSharedClientEntryIfUnclaimed, n as CODEX_AUTH_JSON_FILENAME, o as readFirstNonEmptyEnv, p as getSharedCodexAppServerClientState, r as fingerprintApiKeyAuthProfileCacheKey, s as resolveCodexAppServerFallbackApiKeyCacheKey, t as CODEX_APP_SERVER_API_KEY_ENV_VARS, u as createCodexAppServerStartupLifetime, v as ownCodexStartup, w as retireSharedCodexAppServerClientIfCurrent, x as retainSharedClientEntry, y as recordSharedClientAcquireBoundary } from "./auth-cache-key-DvDLHVJe.mjs";
+import { A as waitForCodexDesktopGeneration, C as retirePendingSharedClientEntryIfUnclaimed, D as waitForUnclaimedSharedClientStartup, _ as observeSharedClientAcquire, a as readCodexCliAuthFileApiKey, b as releaseSharedClientEntry, c as resolveCodexAppServerPreparedApiKeyCacheKey, d as getCurrentSharedClientEntry, f as getOrCreateSharedClientEntry, g as observeAcquire, h as notifyDesktopGenerationDrainChecks, i as fingerprintTokenAuthProfileCacheKey, j as readCodexDesktopArtifactTreeFingerprint, k as isCodexDesktopGenerationCurrent, l as closeSharedClientEntryIfUnclaimed, n as CODEX_AUTH_JSON_FILENAME, o as readFirstNonEmptyEnv, p as getSharedCodexAppServerClientState, r as fingerprintApiKeyAuthProfileCacheKey, s as resolveCodexAppServerFallbackApiKeyCacheKey, t as CODEX_APP_SERVER_API_KEY_ENV_VARS, u as createCodexAppServerStartupLifetime, v as ownCodexStartup, w as retireSharedCodexAppServerClientIfCurrent, x as retainSharedClientEntry, y as recordSharedClientAcquireBoundary } from "./auth-cache-key-CXK7tmkb.mjs";
 import { n as resolveCodexAppServerSpawnEnv } from "./transport-stdio-lgeKKHyw.mjs";
 import { n as CodexAppServerAuthProfileUnavailableError, r as formatCodexAuthProfileUnavailableMessage } from "./auth-profile-recovery-BREezV0L.mjs";
 import { a as codexPrewriteRejectionCause } from "./rpc-error-C98SHchT.mjs";
 import { i as withTimeout } from "./timeout-D0mEWSGG.mjs";
 import { n as readCodexSessionMeta } from "./session-catalog-provenance-CmsOE5mh.mjs";
-import { n as observeCodexCatalogClient } from "./session-catalog-events-IoszcO7-.mjs";
-import { n as resolveCodexAppServerRuntimeOptions } from "./config-runtime-B8agjie6.mjs";
+import { n as observeCodexCatalogClient } from "./session-catalog-events-BBV3DMG7.mjs";
+import { n as resolveCodexAppServerRuntimeOptions } from "./config-runtime-DGB1-VbB.mjs";
 import { a as resolveCodexAppServerAuthProfileStore, i as resolveCodexAppServerAuthProfileIdForAgent, r as resolveCodexAppServerAuthProfileId, t as isCodexAppServerNativeAuthProfile } from "./auth-profile-CgHQ8Vot.mjs";
 import { i as isCodexResponsesOAuthCredential, n as createCodexResponsesOAuth, o as resolveCodexResponsesOAuthProfileFingerprint, r as isCodexResponsesOAuth, t as CODEX_RESPONSES_OAUTH_PROVIDER } from "./responses-oauth-twnuTaAa.mjs";
-import { N as isUnsupportedCodexAppServerVersionError, t as CodexAppServerClient } from "./client-BpSxNz4F.mjs";
-import { n as isCodexWebSocketOpenFailure } from "./transport-websocket-DOY0dJXN.mjs";
+import { N as isUnsupportedCodexAppServerVersionError, t as CodexAppServerClient } from "./client-Div-zqnz.mjs";
+import { n as isCodexWebSocketOpenFailure } from "./transport-websocket-CEBjEtFP.mjs";
 import { t as __exportAll } from "./session-binding-sidecars-DijNZb31.mjs";
 import { asOptionalRecord, isRecord } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { createHash, randomUUID } from "node:crypto";
@@ -1561,6 +1561,13 @@ function resolveExplicitChatgptAccountId(credential) {
 }
 //#endregion
 //#region extensions/codex/src/app-server/client-thread-owner.ts
+/** Background custody can survive projection replacement only under its creation policy. */
+function isThreadBackgroundOnly(runtime, threadId, configFingerprint) {
+	if (!runtime || runtime.closed || !runtime.protectedThreads.has(threadId)) return false;
+	const claim = runtime.claimedThreads.get(threadId);
+	const policy = claim?.configFingerprint ?? runtime.retainedThreads.get(threadId)?.configFingerprint;
+	return (!claim || claim.releaseAfterProtection !== void 0) && (configFingerprint === void 0 || policy === configFingerprint);
+}
 function createThreadOwnerToken(threadId, onInvalidated) {
 	const owner = {
 		invalidated: false,
@@ -1928,7 +1935,7 @@ function scheduleRetainedThreadEviction(client, runtime) {
 		evictExpiredRetainedThreads(client, runtime).catch((error) => {
 			embeddedAgentLog$1.warn("codex retained thread expiry failed", { reason: formatErrorMessage$1(error) });
 		});
-	}, Math.max(0, expiresAt - Date.now()));
+	}, Math.max(0, Math.floor(expiresAt - performance.now())));
 	runtime.evictionTimer.unref?.();
 }
 async function releaseRetainedThread(client, runtime, threadId, assertCurrent, withCurrent) {
@@ -1962,7 +1969,7 @@ async function releaseRetainedThread(client, runtime, threadId, assertCurrent, w
 		return true;
 	} catch (error) {
 		if (!runtime.closed && !transition.invalidated && runtime.releasingThreads.get(threadId) === transition && !runtime.retainedThreads.has(threadId) && !runtime.claimedThreads.has(threadId)) {
-			if (retained.ephemeralPolicy === void 0) retained.expiresAt = Date.now() + CODEX_APP_SERVER_LIVE_THREAD_IDLE_TIMEOUT_MS;
+			if (retained.ephemeralPolicy === void 0) retained.expiresAt = performance.now() + CODEX_APP_SERVER_LIVE_THREAD_IDLE_TIMEOUT_MS;
 			const newerThreads = [...runtime.retainedThreads.entries()].filter(([candidateThreadId]) => !olderThreadIds.has(candidateThreadId));
 			for (const [candidateThreadId] of newerThreads) runtime.retainedThreads.delete(candidateThreadId);
 			runtime.retainedThreads.set(threadId, retained);
@@ -1975,7 +1982,7 @@ async function releaseRetainedThread(client, runtime, threadId, assertCurrent, w
 	}
 }
 async function evictExpiredRetainedThreads(client, runtime) {
-	const now = Date.now();
+	const now = performance.now();
 	for (const [threadId, thread] of runtime.retainedThreads) if (thread.expiresAt <= now && !runtime.protectedThreads.has(threadId)) await releaseRetainedThread(client, runtime, threadId);
 	scheduleRetainedThreadEviction(client, runtime);
 }
@@ -2006,7 +2013,7 @@ async function retainCodexAppServerLiveThread(client, threadId, releaseThread, c
 		configFingerprint,
 		ephemeralPolicy,
 		serviceTier,
-		expiresAt: ephemeralPolicy === void 0 ? Date.now() + CODEX_APP_SERVER_LIVE_THREAD_IDLE_TIMEOUT_MS : Number.POSITIVE_INFINITY,
+		expiresAt: ephemeralPolicy === void 0 ? performance.now() + CODEX_APP_SERVER_LIVE_THREAD_IDLE_TIMEOUT_MS : Number.POSITIVE_INFINITY,
 		release: (releaseThread ? physicalThreadReleases.get(releaseThread) ?? releaseThread : void 0) ?? defaultThreadRelease(client)
 	};
 	runtime.retainedThreads.set(threadId, retained);
@@ -2050,7 +2057,7 @@ async function claimCodexAppServerLiveThread(client, threadId, onInvalidated) {
 		return;
 	}
 	return claimCodexAppServerThreadOwnership(client, runtime, threadId, runtime.retainedThreads.get(threadId) ?? {
-		expiresAt: Date.now() + CODEX_APP_SERVER_LIVE_THREAD_IDLE_TIMEOUT_MS,
+		expiresAt: performance.now() + CODEX_APP_SERVER_LIVE_THREAD_IDLE_TIMEOUT_MS,
 		release: defaultThreadRelease(client)
 	}, onInvalidated);
 }
@@ -2058,6 +2065,7 @@ function claimCodexAppServerThreadOwnership(client, runtime, threadId, retained,
 	const previousClaim = runtime.claimedThreads.get(threadId);
 	runtime.retainedThreads.delete(threadId);
 	const claimed = createThreadOwnerToken(threadId, onInvalidated);
+	claimed.configFingerprint = retained.configFingerprint;
 	runtime.claimedThreads.set(threadId, claimed);
 	previousClaim?.invalidate();
 	retained.ownerToken?.invalidate();
@@ -2137,6 +2145,10 @@ function isCodexAppServerLiveThreadClaimed(client, threadId) {
 	const runtime = configuredClients.get(client);
 	return runtime !== void 0 && !runtime.closed && runtime.claimedThreads.has(threadId);
 }
+/** Completed foreground work may leave cleanup custody with native background work. */
+function isCodexAppServerLiveThreadBackgroundOnly(client, threadId, configFingerprint) {
+	return isThreadBackgroundOnly(configuredClients.get(client), threadId, configFingerprint);
+}
 /** Native commands and children can still need an otherwise-idle subscription. */
 function isCodexAppServerLiveThreadProtected(client, threadId) {
 	const runtime = configuredClients.get(client);
@@ -2213,7 +2225,7 @@ function protectCodexAppServerLiveThread(client, threadId) {
 		if (releaseThreadProtection(runtime, threadId)) {
 			const retained = runtime.retainedThreads.get(threadId);
 			if (retained) {
-				if (retained.ephemeralPolicy === void 0) retained.expiresAt = Date.now() + CODEX_APP_SERVER_LIVE_THREAD_IDLE_TIMEOUT_MS;
+				if (retained.ephemeralPolicy === void 0) retained.expiresAt = performance.now() + CODEX_APP_SERVER_LIVE_THREAD_IDLE_TIMEOUT_MS;
 				runtime.retainedThreads.delete(threadId);
 				runtime.retainedThreads.set(threadId, retained);
 			}
@@ -2485,8 +2497,8 @@ async function prepareCodexInferenceRoute(params) {
 				throw new Error("Codex inference route limit reached; start a fresh managed native connection before retrying.");
 			}
 			pending = Promise.all([
-				import("./inference-proxy-BDWV0djM.mjs"),
-				import("./native-subagent-monitor-gqu3TQOv.mjs").then((n) => n.n),
+				import("./inference-proxy-DSnaS-uS.mjs"),
+				import("./native-subagent-monitor-CBYFkNsB.mjs").then((n) => n.n),
 				import("./inference-dispatch-CO6tTs4q.mjs")
 			]).then(([{ createCodexInferenceProxy }, native, { createCodexInferenceModelBinding }]) => {
 				assertClient();
@@ -3301,7 +3313,7 @@ async function startInitializedCodexAppServerClientOnce(params) {
 		} finally {
 			artifactDrain?.cancel();
 		}
-		const runtimeArtifactModule = params.runtimeArtifactMode ? await import("./runtime-artifact-nFHy1R0x.mjs") : void 0;
+		const runtimeArtifactModule = params.runtimeArtifactMode ? await import("./runtime-artifact-CCPLKFGR.mjs") : void 0;
 		const runtimeArtifactBeforeStart = runtimeArtifactModule ? await runtimeArtifactModule.captureCodexAppServerRuntimeArtifactBeforeStart({
 			startOptions,
 			spawnIdentity: resolveCodexAppServerSpawnIdentity(startOptions),
@@ -3555,4 +3567,4 @@ function clearSharedCodexAppServerClientIfCurrentAndUnclaimed(client) {
 	};
 }
 //#endregion
-export { createCodexEphemeralThreadPolicy as $, bindCodexInferenceThread as A, isCodexAppServerClientRuntimeLive as B, CodexThreadBindingConflictError as C, nativeHookRelayUnregisterQueue as D, isCodexContextRestartSelectionChangedError as E, consumeCodexAppServerLiveThread as F, readCodexClientSessionMeta as G, isCodexAppServerLiveThreadProtected as H, ensureCodexAppServerClientRuntime as I, revertCodexAppServerLiveThreadInstructions as J, releaseCodexAppServerLiveThread as K, forgetCodexWorkspaceReferences as L, getCodexInferenceThreadQualification as M, prepareCodexInferenceThreadConfig as N, acquireCodexNativeConfigFence as O, claimCodexAppServerLiveThread as P, rememberCodexRateLimitsRead as Q, hasCodexAppServerLiveThread as R, CodexAdoptedThreadActiveError as S, CodexThreadStartRequestError as T, prepareCodexWorkspaceReferences as U, isCodexAppServerLiveThreadClaimed as V, protectCodexAppServerLiveThread as W, readCodexRateLimitsRevision as X, unsubscribeCodexAppServerLiveThread as Y, readRecentCodexRateLimits as Z, retainSharedCodexAppServerClientIfCurrent as _, clearSharedCodexAppServerClientIfCurrentAndUnclaimed as a, hasLegacyCodexComputerUseMcpPolicy as at, withLeasedCodexAppServerClientStartSelectionRetry as b, getLeasedSharedCodexAppServerClient as c, ensureCodexComputerUseSharedPluginCache as ct, readCodexAppServerClientDesktopGeneration as d, TURN_FINALIZE_DRAIN_ABORT_GRACE_MS as dt, reconcileCodexComputerUseStartArtifacts as et, readCodexAppServerClientDesktopGenerationFingerprint as f, TURN_TERMINAL_SETTLEMENT_TIMEOUT_MS as ft, resolveCodexNativeConfigFenceKey as g, withCodexStartupTimeout as gt, releaseLeasedSharedCodexAppServerClient as h, resolveCodexStartupTimeoutMs as ht, clearSharedCodexAppServerClientIfCurrent as i, resolveClientManagedBundledMarketplacePath as it, getCodexInferenceThread as j, assertCodexInferenceRouteConfig as k, getSharedCodexAppServerClient as l, assertNotSymlink as lt, releaseCodexAppServerClientLease as m, resolveCodexGatewayTimeoutWithGraceMs as mt, captureCodexAppServerClientLifetime as n, resolveCodexAppServerPreparedAuthHandoff as nt, clearSharedCodexAppServerClientIfCurrentAndWait as o, isLegacyCodexComputerUsePluginDisabled as ot, readCodexAppServerClientProcessIdentity as p, isCodexAppServerStartupError as pt, retainCodexAppServerLiveThread as q, captureSharedCodexAppServerCatalogLifetime as r, resolveBundledComputerUseMarketplacePath as rt, createIsolatedCodexAppServerClient as s, resolveManagedCodexComputerUseConfig as st, assertCodexAppServerClientStartSelectionCurrent as t, resolveCodexAppServerAuthAccountCacheKey as tt, isCodexAppServerStartSelectionChangedError as u, CodexAppServerStartupError as ut, shared_client_exports as v, CodexThreadClientReplacementError as w, CODEX_APP_SERVER_CONTEXT_RESTART_SELECTION_CHANGED as x, waitForCodexAppServerClientDesktopGenerationDrain as y, hasCodexAppServerSiblingThreadWork as z };
+export { rememberCodexRateLimitsRead as $, bindCodexInferenceThread as A, isCodexAppServerClientRuntimeLive as B, CodexThreadBindingConflictError as C, nativeHookRelayUnregisterQueue as D, isCodexContextRestartSelectionChangedError as E, consumeCodexAppServerLiveThread as F, protectCodexAppServerLiveThread as G, isCodexAppServerLiveThreadClaimed as H, ensureCodexAppServerClientRuntime as I, retainCodexAppServerLiveThread as J, readCodexClientSessionMeta as K, forgetCodexWorkspaceReferences as L, getCodexInferenceThreadQualification as M, prepareCodexInferenceThreadConfig as N, acquireCodexNativeConfigFence as O, claimCodexAppServerLiveThread as P, readRecentCodexRateLimits as Q, hasCodexAppServerLiveThread as R, CodexAdoptedThreadActiveError as S, CodexThreadStartRequestError as T, isCodexAppServerLiveThreadProtected as U, isCodexAppServerLiveThreadBackgroundOnly as V, prepareCodexWorkspaceReferences as W, unsubscribeCodexAppServerLiveThread as X, revertCodexAppServerLiveThreadInstructions as Y, readCodexRateLimitsRevision as Z, retainSharedCodexAppServerClientIfCurrent as _, withCodexStartupTimeout as _t, clearSharedCodexAppServerClientIfCurrentAndUnclaimed as a, resolveClientManagedBundledMarketplacePath as at, withLeasedCodexAppServerClientStartSelectionRetry as b, getLeasedSharedCodexAppServerClient as c, resolveManagedCodexComputerUseConfig as ct, readCodexAppServerClientDesktopGeneration as d, CodexAppServerStartupError as dt, createCodexEphemeralThreadPolicy as et, readCodexAppServerClientDesktopGenerationFingerprint as f, TURN_FINALIZE_DRAIN_ABORT_GRACE_MS as ft, resolveCodexNativeConfigFenceKey as g, resolveCodexStartupTimeoutMs as gt, releaseLeasedSharedCodexAppServerClient as h, resolveCodexGatewayTimeoutWithGraceMs as ht, clearSharedCodexAppServerClientIfCurrent as i, resolveBundledComputerUseMarketplacePath as it, getCodexInferenceThread as j, assertCodexInferenceRouteConfig as k, getSharedCodexAppServerClient as l, ensureCodexComputerUseSharedPluginCache as lt, releaseCodexAppServerClientLease as m, isCodexAppServerStartupError as mt, captureCodexAppServerClientLifetime as n, resolveCodexAppServerAuthAccountCacheKey as nt, clearSharedCodexAppServerClientIfCurrentAndWait as o, hasLegacyCodexComputerUseMcpPolicy as ot, readCodexAppServerClientProcessIdentity as p, TURN_TERMINAL_SETTLEMENT_TIMEOUT_MS as pt, releaseCodexAppServerLiveThread as q, captureSharedCodexAppServerCatalogLifetime as r, resolveCodexAppServerPreparedAuthHandoff as rt, createIsolatedCodexAppServerClient as s, isLegacyCodexComputerUsePluginDisabled as st, assertCodexAppServerClientStartSelectionCurrent as t, reconcileCodexComputerUseStartArtifacts as tt, isCodexAppServerStartSelectionChangedError as u, assertNotSymlink as ut, shared_client_exports as v, CodexThreadClientReplacementError as w, CODEX_APP_SERVER_CONTEXT_RESTART_SELECTION_CHANGED as x, waitForCodexAppServerClientDesktopGenerationDrain as y, hasCodexAppServerSiblingThreadWork as z };

package/dist/.setup/{side-question-DNEeROvz.mjs → side-question-D1Wa21s9.mjs}

@@ -1,29 +1,29 @@
 import { i as isJsonObject } from "./protocol-CANUwXJ3.mjs";
 import { m as sessionBindingIdentity } from "./session-binding-record-C2kDBZhx.mjs";
-import { c as withMcpElicitationsApprovalPolicy, d as readCodexRequirementsToml, n as hasCodexMcpToolApprovalOverrides, s as shouldAutoApproveCodexAppServerApprovals } from "./config-security-D0hAOQRI.mjs";
+import { c as withMcpElicitationsApprovalPolicy, d as readCodexRequirementsToml, n as hasCodexMcpToolApprovalOverrides, s as shouldAutoApproveCodexAppServerApprovals } from "./config-security-DpkGNy5T.mjs";
 import { c as isCodexPairedNodeRemoteExecPlacementSandbox, d as readCodexPluginConfig, l as isCodexRemoteExecPlacementSandbox, u as isCodexSandboxExecServerEnabled } from "./config-parsing-CVK2Q463.mjs";
-import { i as resolveCodexAppServerHomeScope, l as resolveCodexModelBackedReviewerPolicyContext } from "./config-options-nvYwVDyy.mjs";
+import { i as resolveCodexAppServerHomeScope, l as resolveCodexModelBackedReviewerPolicyContext } from "./config-options-CZmH25Xq.mjs";
 import { n as formatCodexUsageLimitErrorMessage } from "./rate-limits-CI8pTPqL.mjs";
-import { i as resolveCodexBindingAppServerConnection, r as requireCodexSupervisionModelSelection } from "./binding-connection-X1ZeEDz8.mjs";
-import { n as canUseCodexModelBackedApprovalsReviewerForModel, r as resolveOpenClawExecPolicyForCodexAppServer } from "./config-G4IGX6bK.mjs";
-import { Z as readRecentCodexRateLimits, b as withLeasedCodexAppServerClientStartSelectionRetry, c as getLeasedSharedCodexAppServerClient, m as releaseCodexAppServerClientLease, nt as resolveCodexAppServerPreparedAuthHandoff } from "./shared-client-wb1JBldZ.mjs";
-import { E as resolveDynamicToolCallTimeoutMs, O as toCodexDynamicToolProtocolResponse, T as handleDynamicToolCallWithTimeout, _ as assertCodexTurnStartResponse, a as isCodexAppServerIndeterminateRequestCancellationError, k as resolveCodexToolAbortTerminalReason, m as assertCodexThreadForkResponse, r as isCodexAppServerApprovalRequest, w as createCodexElicitationResponse, y as readCodexDynamicToolCallParams } from "./client-BpSxNz4F.mjs";
-import { d as terminateCodexBackgroundTerminals, f as unsubscribeCodexThreadBestEffort, l as retireUnsafeCodexTurnClientBestEffort, s as interruptCodexTurnAndWaitBestEffort } from "./attempt-client-cleanup-TScCVTsk.mjs";
-import { t as CodexEphemeralTurn } from "./ephemeral-turn-C6aFeGFS.mjs";
-import { d as mergeCodexThreadConfigs, f as refreshCodexPluginAppApprovalPolicy } from "./project-doc-thread-config-B2ZD23A_.mjs";
+import { i as resolveCodexBindingAppServerConnection, r as requireCodexSupervisionModelSelection } from "./binding-connection-C0t9TBX_.mjs";
+import { n as canUseCodexModelBackedApprovalsReviewerForModel, r as resolveOpenClawExecPolicyForCodexAppServer } from "./config-LQemoqTL.mjs";
+import { Q as readRecentCodexRateLimits, b as withLeasedCodexAppServerClientStartSelectionRetry, c as getLeasedSharedCodexAppServerClient, m as releaseCodexAppServerClientLease, rt as resolveCodexAppServerPreparedAuthHandoff } from "./shared-client-CNGDTv68.mjs";
+import { E as resolveDynamicToolCallTimeoutMs, O as toCodexDynamicToolProtocolResponse, T as handleDynamicToolCallWithTimeout, _ as assertCodexTurnStartResponse, a as isCodexAppServerIndeterminateRequestCancellationError, k as resolveCodexToolAbortTerminalReason, m as assertCodexThreadForkResponse, r as isCodexAppServerApprovalRequest, w as createCodexElicitationResponse, y as readCodexDynamicToolCallParams } from "./client-Div-zqnz.mjs";
+import { d as terminateCodexBackgroundTerminals, f as unsubscribeCodexThreadBestEffort, l as retireUnsafeCodexTurnClientBestEffort, s as interruptCodexTurnAndWaitBestEffort } from "./attempt-client-cleanup-BVww-ct8.mjs";
+import { t as CodexEphemeralTurn } from "./ephemeral-turn-K_d99r9P.mjs";
+import { d as mergeCodexThreadConfigs, f as refreshCodexPluginAppApprovalPolicy } from "./project-doc-thread-config-D_sWbxFR.mjs";
 import { n as resolveCodexAppServerReasoningEffort, t as readCodexSupportedReasoningEfforts } from "./reasoning-effort-CS9kKWB9.mjs";
-import { h as resolveCodexWebSearchPlan, r as buildCodexRuntimeThreadConfig, z as resolveCodexDynamicToolsLoading } from "./thread-requests-BqPhA4Gs.mjs";
+import { h as resolveCodexWebSearchPlan, r as buildCodexRuntimeThreadConfig, z as resolveCodexDynamicToolsLoading } from "./thread-requests-DjyDmCo4.mjs";
 import { i as resolveCodexSessionBinding } from "./session-binding-BDnNz-Co.mjs";
 import { i as resolveCodexAppServerThreadModelSelection, t as CODEX_NATIVE_PERSONALITY_NONE } from "./thread-model-selection-DcVebr8N.mjs";
 import { t as resolveCodexNativeExecutionBlock } from "./sandbox-guard-Cf9XMRrg.mjs";
-import { i as assertCodexSupervisionThreadLineage, n as CodexThreadPolicyHandoffError, o as refreshCodexThreadPolicy } from "./thread-policy-BMRvlOi-.mjs";
+import { i as assertCodexSupervisionThreadLineage, n as CodexThreadPolicyHandoffError, o as refreshCodexThreadPolicy } from "./thread-policy-BEiS7ITh.mjs";
 import { o as runCodexCleanupStep } from "./run-attempt-lifecycle-DN-ATDp9.mjs";
-import { a as resolveCodexExternalSandboxPolicyForOpenClawSandbox, c as shouldEnableCodexAppServerNativeToolSurface, l as shouldRequireCodexSandboxExecServerEnvironment, o as resolveCodexMessageToolProvider, s as resolveCodexSandboxEnvironmentSelection, t as buildDynamicTools } from "./dynamic-tool-build-CoMf7IKx.mjs";
-import { a as buildCodexNativeHookRelayDisabledConfig, i as buildCodexNativeHookRelayConfig, l as resolveCodexNativeHookRelayEvents, u as resolveCodexNativeHookRelayTtlMs } from "./native-hook-relay-BQ9UkpeG.mjs";
-import { i as resolveCodexSessionPermissionCwd, n as applyCodexSessionPermissionPolicy, r as resolveCodexEffectiveSessionPermissionPolicy, t as CODEX_SESSION_PERMISSION_EXEC_MODES } from "./session-permission-policy-BYI6mp5u.mjs";
-import { a as handleCodexAppServerApprovalRequest, c as createCodexNativePreToolUseFailureBuffer, d as buildCodexTemporalAdditionalContext, g as buildCodexUserInput, i as createCodexDynamicToolDiagnostics, o as ensureCodexSandboxExecServerEnvironment, r as routeCodexAppServerElicitationRequest, s as releaseCodexSandboxExecServerEnvironment, t as createCodexDynamicToolBridge, y as CodexNativeToolLifecycleProjector } from "./dynamic-tools-CKynHtxM.mjs";
-import { t as resolveCodexAppServerForModelProvider } from "./app-server-policy-XTIa6h5k.mjs";
-import { n as resolveCodexProviderWebSearchSupportForClient } from "./provider-capabilities-DOBUBt86.mjs";
+import { a as resolveCodexExternalSandboxPolicyForOpenClawSandbox, c as shouldEnableCodexAppServerNativeToolSurface, l as shouldRequireCodexSandboxExecServerEnvironment, o as resolveCodexMessageToolProvider, s as resolveCodexSandboxEnvironmentSelection, t as buildDynamicTools } from "./dynamic-tool-build-DjbDZzOJ.mjs";
+import { a as buildCodexNativeHookRelayDisabledConfig, i as buildCodexNativeHookRelayConfig, l as resolveCodexNativeHookRelayEvents, u as resolveCodexNativeHookRelayTtlMs } from "./native-hook-relay-BvwSj5bt.mjs";
+import { i as resolveCodexSessionPermissionCwd, n as applyCodexSessionPermissionPolicy, r as resolveCodexEffectiveSessionPermissionPolicy, t as CODEX_SESSION_PERMISSION_EXEC_MODES } from "./session-permission-policy-C7kYxPGd.mjs";
+import { a as handleCodexAppServerApprovalRequest, c as createCodexNativePreToolUseFailureBuffer, d as buildCodexTemporalAdditionalContext, g as buildCodexUserInput, i as createCodexDynamicToolDiagnostics, o as ensureCodexSandboxExecServerEnvironment, r as routeCodexAppServerElicitationRequest, s as releaseCodexSandboxExecServerEnvironment, t as createCodexDynamicToolBridge, y as CodexNativeToolLifecycleProjector } from "./dynamic-tools-75qoSOch.mjs";
+import { t as resolveCodexAppServerForModelProvider } from "./app-server-policy-V8zuN8q_.mjs";
+import { n as resolveCodexProviderWebSearchSupportForClient } from "./provider-capabilities-B-pTlDsf.mjs";
 import { readStringField } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { randomUUID } from "node:crypto";
 import { isDeepStrictEqual } from "node:util";

package/dist/.setup/{source-BjBw-zoV.mjs → source-DyVuYlTN.mjs}

@@ -1,7 +1,7 @@
 import { a as defaultCodexAppInventoryCache, r as buildCodexPluginAppCacheKey } from "./plugin-app-cache-key-Bg9DbDI6.mjs";
-import { a as withCodexAppServerJsonClient } from "./request-DhbisYCc.mjs";
-import { a as marketplaceRef, o as pluginReadParams, r as isOpenAiCuratedMarketplaceName, u as CODEX_PLUGINS_MARKETPLACE_NAME } from "./plugin-inventory-kLR7G02h.mjs";
-import "./config-G4IGX6bK.mjs";
+import { a as withCodexAppServerJsonClient } from "./request-m-H-7FMu.mjs";
+import { a as marketplaceRef, o as pluginReadParams, r as isOpenAiCuratedMarketplaceName, u as CODEX_PLUGINS_MARKETPLACE_NAME } from "./plugin-inventory-OhiCoyPH.mjs";
+import "./config-LQemoqTL.mjs";
 import { t as __exportAll } from "./session-binding-sidecars-DijNZb31.mjs";
 import { asNonArrayRecord } from "openclaw/plugin-sdk/string-coerce-runtime";
 import path from "node:path";

package/dist/.setup/{thread-lifecycle-run-DdwKMIae.mjs → thread-lifecycle-run-DjSfTw6v.mjs}

@@ -1,11 +1,11 @@
 import { i as isJsonObject, r as flattenCodexDynamicToolFunctions } from "./protocol-CANUwXJ3.mjs";
 import { n as matchesPendingSupervisionBranch } from "./session-binding-record-codec-CWQXr9os.mjs";
 import { m as sessionBindingIdentity, n as assertCodexBindingMayBeReplaced } from "./session-binding-record-C2kDBZhx.mjs";
-import { l as fingerprintCodexPolicy } from "./config-security-D0hAOQRI.mjs";
+import { l as fingerprintCodexPolicy } from "./config-security-DpkGNy5T.mjs";
 import { f as resolveCodexPluginsPolicy } from "./config-parsing-CVK2Q463.mjs";
 import { n as resolveCodexAppServerLocalHomeDir, t as resolveCodexAppServerHomeDir } from "./auth-start-options-BPIPeEX8.mjs";
-import { d as readCodexEffectiveConfig, s as assertCodexModelBackedReviewerEffectiveConfig, u as CODEX_SESSION_OVERRIDABLE_LAYER_TYPES } from "./config-options-nvYwVDyy.mjs";
-import { S as retainSharedCodexAppServerClientByInstanceId, d as getCurrentSharedClientEntry } from "./auth-cache-key-DvDLHVJe.mjs";
+import { d as readCodexEffectiveConfig, s as assertCodexModelBackedReviewerEffectiveConfig, u as CODEX_SESSION_OVERRIDABLE_LAYER_TYPES } from "./config-options-CZmH25Xq.mjs";
+import { S as retainSharedCodexAppServerClientByInstanceId, d as getCurrentSharedClientEntry } from "./auth-cache-key-CXK7tmkb.mjs";
 import { t as withCodexAppServerThreadMutation } from "./thread-ownership-queue-CeyYScUC.mjs";
 import { o as isCodexAppServerOverloadError, r as CodexAppServerRpcError, s as isCodexThreadReadMissingError } from "./rpc-error-C98SHchT.mjs";
 import { t as codexCatalogHomeId } from "./session-catalog-home-id-vlih0B_g.mjs";
@@ -13,34 +13,34 @@ import { r as withAbortableTimeout } from "./timeout-D0mEWSGG.mjs";
 import { t as projectBoundedCodexThreadHistory } from "./transcript-history-projection-DfKcoZCB.mjs";
 import { a as defaultCodexAppInventoryCache, t as buildCodexAppServerConnectionFingerprint } from "./plugin-app-cache-key-Bg9DbDI6.mjs";
 import { n as readCodexSessionMeta } from "./session-catalog-provenance-CmsOE5mh.mjs";
-import { t as assertCodexSessionRuntimeOwnership } from "./binding-connection-X1ZeEDz8.mjs";
-import { c as resolveRecoverableCodexPluginConfigKeys } from "./plugin-inventory-kLR7G02h.mjs";
-import "./config-G4IGX6bK.mjs";
+import { t as assertCodexSessionRuntimeOwnership } from "./binding-connection-C0t9TBX_.mjs";
+import { c as resolveRecoverableCodexPluginConfigKeys } from "./plugin-inventory-OhiCoyPH.mjs";
+import "./config-LQemoqTL.mjs";
 import { c as resolveCodexContextEngineProjectionMaxChars } from "./context-engine-projection-ps-yn_ci.mjs";
 import { n as normalizeCodexAppServerBindingModelProvider } from "./auth-profile-CgHQ8Vot.mjs";
-import { $ as createCodexEphemeralThreadPolicy, A as bindCodexInferenceThread, B as isCodexAppServerClientRuntimeLive, C as CodexThreadBindingConflictError, F as consumeCodexAppServerLiveThread, H as isCodexAppServerLiveThreadProtected, K as releaseCodexAppServerLiveThread, M as getCodexInferenceThreadQualification, N as prepareCodexInferenceThreadConfig, S as CodexAdoptedThreadActiveError, T as CodexThreadStartRequestError, V as isCodexAppServerLiveThreadClaimed, Y as unsubscribeCodexAppServerLiveThread, j as getCodexInferenceThread, k as assertCodexInferenceRouteConfig, n as captureCodexAppServerClientLifetime, w as CodexThreadClientReplacementError, z as hasCodexAppServerSiblingThreadWork } from "./shared-client-wb1JBldZ.mjs";
-import { C as resolveCodexThreadRolloutPath, F as getCodexAppServerClientInstanceId, L as resolveCodexAppServerClientInstanceId, S as readSupervisionResponseThreadId, c as isCodexAppServerRequestTimeoutError, g as assertCodexThreadStartResponse, m as assertCodexThreadForkResponse, p as assertCodexThreadAcceptsDirectInput, v as assertExactSupervisionModelSelection } from "./client-BpSxNz4F.mjs";
-import { r as hasCodexAppServerSiblingRouteWork } from "./turn-router-DdlzuFdm.mjs";
-import { f as unsubscribeCodexThreadBestEffort, l as retireUnsafeCodexTurnClientBestEffort, n as CODEX_APP_SERVER_UNSUBSCRIBE_TIMEOUT_MS, o as closeCodexStartupClientBestEffort, r as CodexAppServerUnsafeSubscriptionError } from "./attempt-client-cleanup-TScCVTsk.mjs";
-import { a as buildCodexPluginThreadConfigInputFingerprint, c as buildPluginAppPolicyContext, d as mergeCodexThreadConfigs, i as buildCodexPluginThreadConfig, l as disableUnlistedCodexApps, m as buildCodexAppApprovalOverrides, n as mergeCodexNativeProjectDocThreadConfig, o as buildCodexPluginThreadConfigTimeoutFallback, p as shouldBuildCodexPluginThreadConfig, r as buildCodexPluginAppsConfigPatchFromPolicyContext, u as isCodexPluginThreadBindingStale } from "./project-doc-thread-config-B2ZD23A_.mjs";
-import { A as isTransientWebSearchRestriction, C as fingerprintEnvironmentSelection, D as readActiveCodexTurnIdsFromResume, E as legacyFingerprintUserMcpServersConfigPatch, I as isMessageOnlyCodexSourceReply, L as isSystemAgentOnlyCodexDynamicToolAllowlist, M as shouldRotateCodexAppServerBindingForRuntime, N as shouldRotateCodexGpt56MultiAgentBinding, O as shouldStartTransientNoToolThread, S as fingerprintCodexThreadConfig, T as fingerprintUserMcpServersConfigPatch, _ as buildDeveloperInstructions, b as codexDynamicToolsFingerprint, c as codexThreadSandboxOrPermissions, d as readCodexManagedRequirementsFingerprint, f as resolveCodexThreadApprovalsReviewer, g as mergeCodexNativeShellEnvironment, h as resolveCodexWebSearchPlan, i as buildCodexRuntimeThreadConfigForRun, j as shouldRecheckRecoverablePluginBinding, n as buildCodexRingZeroThreadConfigPatch, o as buildThreadResumeParams, p as attestCodexRestrictedToolSurfaceMcpServersDisabled, s as buildThreadStartParams, t as assertCodexManagedRequirementsDoNotOverrideToolPolicy, u as readCodexInheritedMcpServerNames, v as areCodexDynamicToolFingerprintsCompatible, w as fingerprintJsonObject, x as codexLegacyDynamicToolsFingerprint, y as areUserMcpServersFingerprintsCompatible } from "./thread-requests-BqPhA4Gs.mjs";
+import { A as bindCodexInferenceThread, B as isCodexAppServerClientRuntimeLive, C as CodexThreadBindingConflictError, F as consumeCodexAppServerLiveThread, H as isCodexAppServerLiveThreadClaimed, M as getCodexInferenceThreadQualification, N as prepareCodexInferenceThreadConfig, S as CodexAdoptedThreadActiveError, T as CodexThreadStartRequestError, U as isCodexAppServerLiveThreadProtected, V as isCodexAppServerLiveThreadBackgroundOnly, X as unsubscribeCodexAppServerLiveThread, et as createCodexEphemeralThreadPolicy, j as getCodexInferenceThread, k as assertCodexInferenceRouteConfig, n as captureCodexAppServerClientLifetime, q as releaseCodexAppServerLiveThread, w as CodexThreadClientReplacementError, z as hasCodexAppServerSiblingThreadWork } from "./shared-client-CNGDTv68.mjs";
+import { C as resolveCodexThreadRolloutPath, F as getCodexAppServerClientInstanceId, L as resolveCodexAppServerClientInstanceId, S as readSupervisionResponseThreadId, c as isCodexAppServerRequestTimeoutError, g as assertCodexThreadStartResponse, m as assertCodexThreadForkResponse, p as assertCodexThreadAcceptsDirectInput, v as assertExactSupervisionModelSelection } from "./client-Div-zqnz.mjs";
+import { r as hasCodexAppServerSiblingRouteWork } from "./turn-router-DM0fRrYI.mjs";
+import { f as unsubscribeCodexThreadBestEffort, l as retireUnsafeCodexTurnClientBestEffort, n as CODEX_APP_SERVER_UNSUBSCRIBE_TIMEOUT_MS, o as closeCodexStartupClientBestEffort, r as CodexAppServerUnsafeSubscriptionError } from "./attempt-client-cleanup-BVww-ct8.mjs";
+import { a as buildCodexPluginThreadConfigInputFingerprint, c as buildPluginAppPolicyContext, d as mergeCodexThreadConfigs, i as buildCodexPluginThreadConfig, l as disableUnlistedCodexApps, m as buildCodexAppApprovalOverrides, n as mergeCodexNativeProjectDocThreadConfig, o as buildCodexPluginThreadConfigTimeoutFallback, p as shouldBuildCodexPluginThreadConfig, r as buildCodexPluginAppsConfigPatchFromPolicyContext, u as isCodexPluginThreadBindingStale } from "./project-doc-thread-config-D_sWbxFR.mjs";
+import { A as isTransientWebSearchRestriction, C as fingerprintEnvironmentSelection, D as readActiveCodexTurnIdsFromResume, E as legacyFingerprintUserMcpServersConfigPatch, I as isMessageOnlyCodexSourceReply, L as isSystemAgentOnlyCodexDynamicToolAllowlist, M as shouldRotateCodexAppServerBindingForRuntime, N as shouldRotateCodexGpt56MultiAgentBinding, O as shouldStartTransientNoToolThread, S as fingerprintCodexThreadConfig, T as fingerprintUserMcpServersConfigPatch, _ as buildDeveloperInstructions, b as codexDynamicToolsFingerprint, c as codexThreadSandboxOrPermissions, d as readCodexManagedRequirementsFingerprint, f as resolveCodexThreadApprovalsReviewer, g as mergeCodexNativeShellEnvironment, h as resolveCodexWebSearchPlan, i as buildCodexRuntimeThreadConfigForRun, j as shouldRecheckRecoverablePluginBinding, n as buildCodexRingZeroThreadConfigPatch, o as buildThreadResumeParams, p as attestCodexRestrictedToolSurfaceMcpServersDisabled, s as buildThreadStartParams, t as assertCodexManagedRequirementsDoNotOverrideToolPolicy, u as readCodexInheritedMcpServerNames, v as areCodexDynamicToolFingerprintsCompatible, w as fingerprintJsonObject, x as codexLegacyDynamicToolsFingerprint, y as areUserMcpServersFingerprintsCompatible } from "./thread-requests-DjyDmCo4.mjs";
 import { i as resolveCodexSessionBinding, o as hashCodexAppServerBindingFingerprint } from "./session-binding-BDnNz-Co.mjs";
 import { i as resolveCodexAppServerThreadModelSelection, n as resolveCodexAppServerModelProvider } from "./thread-model-selection-DcVebr8N.mjs";
-import { c as withExclusiveCodexAppServerThread, r as retainCodexAppServerBindingSubscription, t as isSameCodexAppServerThreadOwner } from "./thread-ownership-CTUs8Eyu.mjs";
-import { a as refreshCodexThreadInstructions, i as assertCodexSupervisionThreadLineage, n as CodexThreadPolicyHandoffError, o as refreshCodexThreadPolicy, r as assertAdoptedCodexThreadResumeAllowed, t as CodexIncognitoPolicyChangeError } from "./thread-policy-BMRvlOi-.mjs";
-import { t as resumeCodexAppServerThread } from "./thread-resume-CD48Vab8.mjs";
+import { c as withExclusiveCodexAppServerThread, r as retainCodexAppServerBindingSubscription, t as isSameCodexAppServerThreadOwner } from "./thread-ownership-BBsOFzCM.mjs";
+import { a as refreshCodexThreadInstructions, i as assertCodexSupervisionThreadLineage, n as CodexThreadPolicyHandoffError, o as refreshCodexThreadPolicy, r as assertAdoptedCodexThreadResumeAllowed, t as CodexIncognitoPolicyChangeError } from "./thread-policy-BEiS7ITh.mjs";
+import { t as resumeCodexAppServerThread } from "./thread-resume-BqOca2Iy.mjs";
 import { r as readCodexMcpToolConnectorId } from "./mcp-tool-metadata-_sawBkIh.mjs";
-import { n as disableCodexPluginThreadConfig } from "./dynamic-tool-build-CoMf7IKx.mjs";
-import { n as CodexManagedHooksOnlyError, r as assertCodexNativeHookRelayAllowed } from "./native-hook-relay-BQ9UkpeG.mjs";
+import { n as disableCodexPluginThreadConfig } from "./dynamic-tool-build-DjbDZzOJ.mjs";
+import { n as CodexManagedHooksOnlyError, r as assertCodexNativeHookRelayAllowed } from "./native-hook-relay-BvwSj5bt.mjs";
 import { t as defaultCodexPluginMetadataCache } from "./plugin-metadata-cache-Bi8TAPwX.mjs";
-import { a as discardUnattestedCodexPluginThread, i as checkCodexThreadAppAvailability, n as resolveCodexNativeSkillIsolation, o as hasCodexNativeToolCatalog, r as attestCodexThreadToolSurface, s as loadCodexNativeToolCatalog, t as applyCodexNativeSkillIsolation } from "./native-skill-isolation-CxZRtiWZ.mjs";
+import { a as discardUnattestedCodexPluginThread, i as checkCodexThreadAppAvailability, n as resolveCodexNativeSkillIsolation, o as hasCodexNativeToolCatalog, r as attestCodexThreadToolSurface, s as loadCodexNativeToolCatalog, t as applyCodexNativeSkillIsolation } from "./native-skill-isolation-Cx2AkUco.mjs";
 import { asOptionalRecord, normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
 import crypto from "node:crypto";
 import { isDeepStrictEqual } from "node:util";
 import { resolveSessionAgentIdsStrict } from "openclaw/plugin-sdk/agent-scope-runtime";
 import path from "node:path";
-import { isIncognitoSessionKey } from "openclaw/plugin-sdk/session-key-runtime";
 import { createStageTimingTracker, formatStageTimings, racePromiseWithAbortSignal } from "openclaw/plugin-sdk/time-runtime";
+import { isIncognitoSessionKey } from "openclaw/plugin-sdk/session-key-runtime";
 import { resolveAgentDir as resolveAgentDir$1 } from "openclaw/plugin-sdk/agent-runtime";
 import { AgentHarnessPreflightError, embeddedAgentLog, formatErrorMessage, isActiveHarnessContextEngine, isHostScopedAgentToolActive } from "openclaw/plugin-sdk/agent-harness-runtime";
 import { buildCodexUserMcpServersThreadConfigPatchForRun } from "openclaw/plugin-sdk/codex-mcp-projection";
@@ -1216,7 +1216,10 @@ async function releaseCodexRetainedLiveThread(options) {
 /** Release follows the physical owner across connection rotation, never a copied thread id. */
 async function releaseCodexBoundLiveThread(options) {
 	const changedClient = options.ownerClientId && options.ownerClientId !== options.clientId;
-	const previous = changedClient ? await retainSharedCodexAppServerClientByInstanceId(options.ownerClientId) : void 0;
+	const previous = changedClient ? await retainSharedCodexAppServerClientByInstanceId(options.ownerClientId, {
+		signal: options.signal,
+		createAbortError: codexThreadLifecycleAbortError
+	}) : void 0;
 	if (changedClient && !previous) return false;
 	const client = previous?.client ?? options.client;
 	try {
@@ -1580,6 +1583,16 @@ function observeCodexThreadConfiguration(params, thread, assertCurrent) {
 	};
 }
 //#endregion
+//#region extensions/codex/src/app-server/thread-lifecycle-projection.ts
+/** Projection identity omits persistent instructions: qualify using warm reuse's full policy. */
+async function canRetainCodexProjectionBackgroundWork(params, binding, context, pluginThreadConfig) {
+	const finalConfig = await prepareCodexThreadFinalConfigPatch(params, context.nativeModelInputTools, binding);
+	const pluginConfig = pluginThreadConfig?.configPatch ?? (params.pluginThreadConfig?.enabled && binding.pluginAppPolicyContext ? buildCodexPluginAppsConfigPatchFromPolicyContext(binding.pluginAppPolicyContext) : void 0);
+	const authProfileId = binding.connectionScope === "supervision" ? void 0 : params.params.authProfileId ?? binding.authProfileId;
+	const resumeParams = context.buildResumeParams(binding, authProfileId, buildCodexThreadRequestConfig(params, context, pluginConfig, finalConfig.configPatch));
+	return isCodexAppServerLiveThreadBackgroundOnly(params.client, binding.threadId, fingerprintCodexThreadConfig(resumeParams, authProfileId, context.dynamicToolsFingerprint, binding));
+}
+//#endregion
 //#region extensions/codex/src/app-server/thread-supervision-cleanup.ts
 function withPendingSupervisionCleanup(pending, cleanupThreadIds) {
 	return {
@@ -1917,6 +1930,7 @@ async function startOrResumeThread(input) {
 		const preflight = await prepareCodexThreadLifecyclePreflight(params);
 		const callerConfig = params.config;
 		const { contextEngineBinding, dynamicToolsContainDeferred, dynamicToolsFingerprint, hostSystemAgentActive, legacyDynamicToolsFingerprint, legacyUserMcpServersFingerprint, lifecycleTiming, nativeSkillIsolationFingerprint, networkProxyConfigFingerprint, ringZeroActive, ringZeroClientInstanceId, ringZeroConfigFingerprint, restrictedToolSurface, restrictedToolSurfaceInheritedMcpServerNames, userMcpServersFingerprint, webSearchThreadConfigFingerprint } = preflight;
+		let retainBackgroundPredecessor = false;
 		let replacementPredecessor;
 		const initialBoundThreadId = binding?.threadId;
 		const initialBoundClientId = binding?.clientId;
@@ -2101,21 +2115,6 @@ async function startOrResumeThread(input) {
 			embeddedAgentLog.debug("codex app-server delegation restricted for turn; starting transient thread", { threadId: binding.threadId });
 			binding = void 0;
 		}
-		if (binding?.threadId && (binding.contextEngine || contextEngineBinding)) {
-			if (!contextEngineBinding || !isContextEngineBindingCompatible(binding.contextEngine, contextEngineBinding)) {
-				rotateStaleBinding(binding, "context-engine binding", {
-					engineId: contextEngineBinding?.engineId,
-					previousEngineId: binding.contextEngine?.engineId,
-					epoch: contextEngineBinding?.projection?.epoch,
-					previousEpoch: binding.contextEngine?.projection?.epoch,
-					fingerprint: contextEngineBinding?.projection?.fingerprint,
-					previousFingerprint: binding.contextEngine?.projection?.fingerprint,
-					policyFingerprint: contextEngineBinding?.policyFingerprint,
-					previousPolicyFingerprint: binding.contextEngine?.policyFingerprint
-				});
-				rotatedContextEngineBinding = true;
-			}
-		}
 		if (binding?.threadId) {
 			if (!areUserMcpServersFingerprintsCompatible({
 				previous: binding.userMcpServersFingerprint,
@@ -2132,6 +2131,31 @@ async function startOrResumeThread(input) {
 			})) rotateStaleBinding(binding, "plugin app config");
 			else if (binding.dynamicToolsFingerprint && params.dynamicTools.length > 0 && binding.dynamicToolsContainDeferred !== dynamicToolsContainDeferred && (binding.dynamicToolsContainDeferred !== void 0 || !dynamicToolsContainDeferred)) rotateStaleBinding(binding, "dynamic tool loading");
 		}
+		if (binding?.threadId && (binding.contextEngine || contextEngineBinding)) {
+			if (!contextEngineBinding || !isContextEngineBindingCompatible(binding.contextEngine, contextEngineBinding)) {
+				retainBackgroundPredecessor = initialBoundClientId === clientId && binding.contextEngine?.engineId === contextEngineBinding?.engineId && binding.contextEngine?.policyFingerprint === contextEngineBinding?.policyFingerprint && Boolean(contextEngineBinding) && (!binding.dynamicToolsFingerprint || areCodexDynamicToolFingerprintsCompatible({
+					previous: binding.dynamicToolsFingerprint,
+					next: dynamicToolsFingerprint,
+					nextLegacy: legacyDynamicToolsFingerprint
+				})) && isCodexAppServerLiveThreadBackgroundOnly(params.client, binding.threadId);
+				if (retainBackgroundPredecessor) {
+					const currentPluginConfig = await buildLoadedPluginThreadConfig(binding);
+					if (currentPluginConfig && currentPluginConfig.fingerprint !== binding.pluginAppsFingerprint) retainBackgroundPredecessor = false;
+				}
+				if (retainBackgroundPredecessor) retainBackgroundPredecessor = await canRetainCodexProjectionBackgroundWork(params, binding, await prepareRequestContext(), prebuiltPluginThreadConfig);
+				rotateStaleBinding(binding, "context-engine binding", {
+					engineId: contextEngineBinding?.engineId,
+					previousEngineId: binding.contextEngine?.engineId,
+					epoch: contextEngineBinding?.projection?.epoch,
+					previousEpoch: binding.contextEngine?.projection?.epoch,
+					fingerprint: contextEngineBinding?.projection?.fingerprint,
+					previousFingerprint: binding.contextEngine?.projection?.fingerprint,
+					policyFingerprint: contextEngineBinding?.policyFingerprint,
+					previousPolicyFingerprint: binding.contextEngine?.policyFingerprint
+				});
+				rotatedContextEngineBinding = true;
+			}
+		}
 		if (binding?.threadId) {
 			if (binding.dynamicToolsFingerprint && !areCodexDynamicToolFingerprintsCompatible({
 				previous: binding.dynamicToolsFingerprint,
@@ -2181,7 +2205,7 @@ async function startOrResumeThread(input) {
 		}
 		assertCodexBindingMayBeReplaced(binding, "starting a fresh native thread", expectedOwnership);
 		const requestContext = await prepareRequestContext();
-		if (initialBoundThreadId && !preserveExistingBinding && !configuredMcpOwnershipChanged) await releaseRetainedThread(initialBoundThreadId);
+		if (initialBoundThreadId && !preserveExistingBinding && !configuredMcpOwnershipChanged && !(retainBackgroundPredecessor && isCodexAppServerLiveThreadBackgroundOnly(params.client, initialBoundThreadId))) await releaseRetainedThread(initialBoundThreadId);
 		const started = await startFreshCodexThread(params, {
 			...requestContext,
 			prebuiltPluginThreadConfig,

package/dist/.setup/{thread-ownership-CTUs8Eyu.mjs → thread-ownership-BBsOFzCM.mjs}

@@ -1,7 +1,7 @@
-import { S as retainSharedCodexAppServerClientByInstanceId } from "./auth-cache-key-DvDLHVJe.mjs";
+import { S as retainSharedCodexAppServerClientByInstanceId } from "./auth-cache-key-CXK7tmkb.mjs";
 import { t as withCodexAppServerThreadMutation } from "./thread-ownership-queue-CeyYScUC.mjs";
-import { K as releaseCodexAppServerLiveThread, V as isCodexAppServerLiveThreadClaimed, q as retainCodexAppServerLiveThread } from "./shared-client-wb1JBldZ.mjs";
-import { f as unsubscribeCodexThreadBestEffort, o as closeCodexStartupClientBestEffort, r as CodexAppServerUnsafeSubscriptionError } from "./attempt-client-cleanup-TScCVTsk.mjs";
+import { H as isCodexAppServerLiveThreadClaimed, J as retainCodexAppServerLiveThread, q as releaseCodexAppServerLiveThread } from "./shared-client-CNGDTv68.mjs";
+import { f as unsubscribeCodexThreadBestEffort, o as closeCodexStartupClientBestEffort, r as CodexAppServerUnsafeSubscriptionError } from "./attempt-client-cleanup-BVww-ct8.mjs";
 import { t as __exportAll } from "./session-binding-sidecars-DijNZb31.mjs";
 import { createDeferred } from "openclaw/plugin-sdk/extension-shared";
 import { runWithAsyncWorkResources } from "openclaw/plugin-sdk/agent-harness-tool-runtime";

package/dist/.setup/{thread-policy-BMRvlOi-.mjs → thread-policy-BEiS7ITh.mjs}

@@ -1,7 +1,7 @@
 import { i as CodexAppServerScopedRequestRejectedError, o as isCodexAppServerOverloadError } from "./rpc-error-C98SHchT.mjs";
-import { n as requestCodexAppServerClientJson } from "./request-DhbisYCc.mjs";
-import { S as CodexAdoptedThreadActiveError } from "./shared-client-wb1JBldZ.mjs";
-import { p as assertCodexThreadAcceptsDirectInput, s as isCodexAppServerPrewriteRequestCancellationError } from "./client-BpSxNz4F.mjs";
+import { n as requestCodexAppServerClientJson } from "./request-m-H-7FMu.mjs";
+import { S as CodexAdoptedThreadActiveError } from "./shared-client-CNGDTv68.mjs";
+import { p as assertCodexThreadAcceptsDirectInput, s as isCodexAppServerPrewriteRequestCancellationError } from "./client-Div-zqnz.mjs";
 import { AgentHarnessPreflightError, embeddedAgentLog, formatErrorMessage } from "openclaw/plugin-sdk/agent-harness-runtime";
 //#region extensions/codex/src/app-server/thread-policy.ts
 /** A refusal, not a failed native write: the ephemeral conversation must stay alive. */

package/dist/.setup/{thread-requests-BqPhA4Gs.mjs → thread-requests-DjyDmCo4.mjs}

@@ -1,7 +1,7 @@
 import { i as isJsonObject } from "./protocol-CANUwXJ3.mjs";
-import { d as readCodexEffectiveConfig, u as CODEX_SESSION_OVERRIDABLE_LAYER_TYPES } from "./config-options-nvYwVDyy.mjs";
+import { d as readCodexEffectiveConfig, u as CODEX_SESSION_OVERRIDABLE_LAYER_TYPES } from "./config-options-CZmH25Xq.mjs";
 import { a as isCodexResponsesOAuthRun } from "./responses-oauth-twnuTaAa.mjs";
-import { d as mergeCodexThreadConfigs, t as buildCodexProjectDocThreadConfig } from "./project-doc-thread-config-B2ZD23A_.mjs";
+import { d as mergeCodexThreadConfigs, t as buildCodexProjectDocThreadConfig } from "./project-doc-thread-config-D_sWbxFR.mjs";
 import { o as hashCodexAppServerBindingFingerprint } from "./session-binding-BDnNz-Co.mjs";
 import { n as resolveCodexAppServerModelProvider, r as resolveCodexAppServerRequestModelSelection, t as CODEX_NATIVE_PERSONALITY_NONE } from "./thread-model-selection-DcVebr8N.mjs";
 import { normalizeOptionalString, normalizeUniqueStringEntries, normalizeUniqueTrimmedStringList } from "openclaw/plugin-sdk/string-coerce-runtime";

package/dist/.setup/{thread-resume-CD48Vab8.mjs → thread-resume-BqOca2Iy.mjs}

@@ -1,8 +1,8 @@
 import { i as CodexAppServerScopedRequestRejectedError, o as isCodexAppServerOverloadError, r as CodexAppServerRpcError } from "./rpc-error-C98SHchT.mjs";
-import { r as publishCodexCatalogResume } from "./session-catalog-events-IoszcO7-.mjs";
-import { L as forgetCodexWorkspaceReferences, pt as isCodexAppServerStartupError, u as isCodexAppServerStartSelectionChangedError } from "./shared-client-wb1JBldZ.mjs";
-import { h as assertCodexThreadResumeResponse, s as isCodexAppServerPrewriteRequestCancellationError } from "./client-BpSxNz4F.mjs";
-import { f as unsubscribeCodexThreadBestEffort, i as assertCodexThreadResumeSubscription, r as CodexAppServerUnsafeSubscriptionError } from "./attempt-client-cleanup-TScCVTsk.mjs";
+import { r as publishCodexCatalogResume } from "./session-catalog-events-BBV3DMG7.mjs";
+import { L as forgetCodexWorkspaceReferences, mt as isCodexAppServerStartupError, u as isCodexAppServerStartSelectionChangedError } from "./shared-client-CNGDTv68.mjs";
+import { h as assertCodexThreadResumeResponse, s as isCodexAppServerPrewriteRequestCancellationError } from "./client-Div-zqnz.mjs";
+import { f as unsubscribeCodexThreadBestEffort, i as assertCodexThreadResumeSubscription, r as CodexAppServerUnsafeSubscriptionError } from "./attempt-client-cleanup-BVww-ct8.mjs";
 import { sanitizeTerminalText } from "openclaw/plugin-sdk/text-chunking";
 //#region extensions/codex/src/app-server/thread-resume.ts
 /** Owns Codex thread/resume subscription safety. */

package/dist/.setup/{transport-websocket-DOY0dJXN.mjs → transport-websocket-CEBjEtFP.mjs}

@@ -1,5 +1,5 @@
 import { r as resolveCodexAppServerUserHomeDir } from "./auth-start-options-BPIPeEX8.mjs";
-import "./config-G4IGX6bK.mjs";
+import "./config-LQemoqTL.mjs";
 import { t as codexWebSocketDataToBuffer } from "./websocket-data-XlRvt8Ys.mjs";
 import path from "node:path";
 import { EventEmitter } from "node:events";

package/dist/.setup/{turn-router-DdlzuFdm.mjs → turn-router-DM0fRrYI.mjs}

@@ -1,6 +1,6 @@
 import { i as isJsonObject } from "./protocol-CANUwXJ3.mjs";
 import { n as waitForPromiseOrAbort, t as abortReason } from "./timeout-D0mEWSGG.mjs";
-import { x as readCodexTurnCompletedNotification } from "./client-BpSxNz4F.mjs";
+import { x as readCodexTurnCompletedNotification } from "./client-Div-zqnz.mjs";
 import { normalizeOptionalString, readStringField } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { AsyncResource } from "node:async_hooks";
 import { createDeferred } from "openclaw/plugin-sdk/extension-shared";

package/dist/.setup/{upstream-session-fork-BF0c69x6.mjs → upstream-session-fork-CxgShpwe.mjs}

@@ -1,7 +1,7 @@
 import { i as isJsonObject, r as flattenCodexDynamicToolFunctions } from "./protocol-CANUwXJ3.mjs";
 import { m as sessionBindingIdentity } from "./session-binding-record-C2kDBZhx.mjs";
 import { d as readCodexPluginConfig } from "./config-parsing-CVK2Q463.mjs";
-import { s as assertCodexModelBackedReviewerEffectiveConfig } from "./config-options-nvYwVDyy.mjs";
+import { s as assertCodexModelBackedReviewerEffectiveConfig } from "./config-options-CZmH25Xq.mjs";
 import { t as withCodexAppServerThreadMutation } from "./thread-ownership-queue-CeyYScUC.mjs";
 import { i as CodexAppServerScopedRequestRejectedError, o as isCodexAppServerOverloadError } from "./rpc-error-C98SHchT.mjs";
 import { a as readUpstreamUserText, i as readMirrorIdentity } from "./upstream-prompt-provenance-Ccd9MFRJ.mjs";
@@ -9,22 +9,22 @@ import { r as projectCodexUserItemText } from "./transcript-history-projection-D
 import { n as codexUpstreamBaseline, t as codexLastTerminalTurnId } from "./session-upstream-marker-D15C9NHp.mjs";
 import { r as buildCodexPluginAppCacheKey } from "./plugin-app-cache-key-Bg9DbDI6.mjs";
 import { n as readCodexSessionMeta } from "./session-catalog-provenance-CmsOE5mh.mjs";
-import "./request-DhbisYCc.mjs";
-import { r as resolveOpenClawExecPolicyForCodexAppServer } from "./config-G4IGX6bK.mjs";
-import { r as resolveCodexSupervisionAppServerRuntimeOptions } from "./config-runtime-B8agjie6.mjs";
+import "./request-m-H-7FMu.mjs";
+import { r as resolveOpenClawExecPolicyForCodexAppServer } from "./config-LQemoqTL.mjs";
+import { r as resolveCodexSupervisionAppServerRuntimeOptions } from "./config-runtime-DGB1-VbB.mjs";
 import { l as readCodexMirrorSourceFingerprint, o as fingerprintCodexMirrorSourceMessage } from "./transcript-mirror-attestation-BzUXnrvv.mjs";
-import { P as claimCodexAppServerLiveThread, R as hasCodexAppServerLiveThread, f as readCodexAppServerClientDesktopGenerationFingerprint } from "./shared-client-wb1JBldZ.mjs";
-import { m as assertCodexThreadForkResponse, p as assertCodexThreadAcceptsDirectInput, s as isCodexAppServerPrewriteRequestCancellationError } from "./client-BpSxNz4F.mjs";
-import { d as mergeCodexThreadConfigs, i as buildCodexPluginThreadConfig, p as shouldBuildCodexPluginThreadConfig } from "./project-doc-thread-config-B2ZD23A_.mjs";
-import { T as fingerprintUserMcpServersConfigPatch, _ as buildDeveloperInstructions, a as buildCodexThreadConfiguration, b as codexDynamicToolsFingerprint, h as resolveCodexWebSearchPlan, w as fingerprintJsonObject } from "./thread-requests-BqPhA4Gs.mjs";
+import { P as claimCodexAppServerLiveThread, R as hasCodexAppServerLiveThread, f as readCodexAppServerClientDesktopGenerationFingerprint } from "./shared-client-CNGDTv68.mjs";
+import { m as assertCodexThreadForkResponse, p as assertCodexThreadAcceptsDirectInput, s as isCodexAppServerPrewriteRequestCancellationError } from "./client-Div-zqnz.mjs";
+import { d as mergeCodexThreadConfigs, i as buildCodexPluginThreadConfig, p as shouldBuildCodexPluginThreadConfig } from "./project-doc-thread-config-D_sWbxFR.mjs";
+import { T as fingerprintUserMcpServersConfigPatch, _ as buildDeveloperInstructions, a as buildCodexThreadConfiguration, b as codexDynamicToolsFingerprint, h as resolveCodexWebSearchPlan, w as fingerprintJsonObject } from "./thread-requests-DjyDmCo4.mjs";
 import "./session-binding-BDnNz-Co.mjs";
-import "./thread-ownership-CTUs8Eyu.mjs";
+import "./thread-ownership-BBsOFzCM.mjs";
 import { n as resolveCodexNativeExecutionPolicy } from "./native-execution-policy-MXEe7PB3.mjs";
-import { n as CodexThreadPolicyHandoffError, o as refreshCodexThreadPolicy } from "./thread-policy-BMRvlOi-.mjs";
-import { b as isCodexDynamicToolExcluded, f as codexNativeHookRemoteCredentialPath, i as buildCodexNativeHookRelayConfig, l as resolveCodexNativeHookRelayEvents, o as buildCodexNativeHookRelayId, r as assertCodexNativeHookRelayAllowed } from "./native-hook-relay-BQ9UkpeG.mjs";
-import { c as parseCodexNativeToolCatalog, i as checkCodexThreadAppAvailability, n as resolveCodexNativeSkillIsolation, t as applyCodexNativeSkillIsolation } from "./native-skill-isolation-CxZRtiWZ.mjs";
-import { c as prepareCodexWorkspaceDeveloperInstructions } from "./attempt-workspace-context-Cr3mI4vp.mjs";
-import { n as resolveCodexProviderWebSearchSupportForClient } from "./provider-capabilities-DOBUBt86.mjs";
+import { n as CodexThreadPolicyHandoffError, o as refreshCodexThreadPolicy } from "./thread-policy-BEiS7ITh.mjs";
+import { b as isCodexDynamicToolExcluded, f as codexNativeHookRemoteCredentialPath, i as buildCodexNativeHookRelayConfig, l as resolveCodexNativeHookRelayEvents, o as buildCodexNativeHookRelayId, r as assertCodexNativeHookRelayAllowed } from "./native-hook-relay-BvwSj5bt.mjs";
+import { c as parseCodexNativeToolCatalog, i as checkCodexThreadAppAvailability, n as resolveCodexNativeSkillIsolation, t as applyCodexNativeSkillIsolation } from "./native-skill-isolation-Cx2AkUco.mjs";
+import { c as prepareCodexWorkspaceDeveloperInstructions } from "./attempt-workspace-context-BkA0W8Jy.mjs";
+import { n as resolveCodexProviderWebSearchSupportForClient } from "./provider-capabilities-B-pTlDsf.mjs";
 import { n as prepareCodexSessionInitialization } from "./session-initialization-BjVtsTzi.mjs";
 import { createImportedCodexSession } from "./session-history-import-DgwRu2eD.mjs";
 import { isRecord, normalizeOptionalString, readNonBlankString } from "openclaw/plugin-sdk/string-coerce-runtime";

package/dist/.setup/{usage-BsMyAOaB.mjs → usage-DV8T9Yau.mjs}

@@ -1,7 +1,7 @@
 import { t as buildCodexAppServerUsageSnapshot } from "./rate-limits-CI8pTPqL.mjs";
-import { t as readCodexAppServerUsage } from "./request-DhbisYCc.mjs";
-import "./config-G4IGX6bK.mjs";
-import { n as resolveCodexAppServerRuntimeOptions } from "./config-runtime-B8agjie6.mjs";
+import { t as readCodexAppServerUsage } from "./request-m-H-7FMu.mjs";
+import "./config-LQemoqTL.mjs";
+import { n as resolveCodexAppServerRuntimeOptions } from "./config-runtime-DGB1-VbB.mjs";
 import { CODEX_APP_SERVER_AUTH_MARKER } from "openclaw/plugin-sdk/agent-runtime";
 //#region extensions/codex/src/app-server/usage.ts
 /** Handles the synthetic usage credential for a Codex-backed OpenAI route. */

package/dist/.setup/{usage-limit-error-hLIGKewV.mjs → usage-limit-error-ryR1PGou.mjs}

@@ -1,7 +1,7 @@
 import { i as isJsonObject } from "./protocol-CANUwXJ3.mjs";
 import { a as shouldRefreshCodexRateLimitsForUsageLimitMessage, i as resolveCodexUsageLimitResetAtMs, n as formatCodexUsageLimitErrorMessage } from "./rate-limits-CI8pTPqL.mjs";
 import { t as CODEX_CONTROL_METHODS } from "./capabilities-DbOzOglY.mjs";
-import { Q as rememberCodexRateLimitsRead, X as readCodexRateLimitsRevision, Z as readRecentCodexRateLimits } from "./shared-client-wb1JBldZ.mjs";
+import { $ as rememberCodexRateLimitsRead, Q as readRecentCodexRateLimits, Z as readCodexRateLimitsRevision } from "./shared-client-CNGDTv68.mjs";
 import { readStringField } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { markAuthProfileBlockedUntil } from "openclaw/plugin-sdk/agent-runtime";
 import { embeddedAgentLog, formatErrorMessage } from "openclaw/plugin-sdk/agent-harness-runtime";

package/dist/.setup/{web-search-provider.runtime-BJK0lNpc.mjs → web-search-provider.runtime-DkciK2gS.mjs}

@@ -1,5 +1,5 @@
-import { m as buildCodexNativeWebSearchThreadConfig } from "./thread-requests-BqPhA4Gs.mjs";
-import { runBoundedCodexAppServerTurn } from "./bounded-turn-BpjZixcd.mjs";
+import { m as buildCodexNativeWebSearchThreadConfig } from "./thread-requests-DjyDmCo4.mjs";
+import { runBoundedCodexAppServerTurn } from "./bounded-turn-vdpL2efh.mjs";
 import { t as projectCodexWebSearchItem } from "./web-search-item-CvokaZOo.mjs";
 import { readStringParam, resolveSearchTimeoutSeconds, wrapWebContent } from "openclaw/plugin-sdk/provider-web-search";
 //#region extensions/codex/src/web-search-provider.runtime.ts

package/dist/.setup/{workspace-write-sandbox-probe-Cyn6cBsp.mjs → workspace-write-sandbox-probe-DvfWTvuR.mjs}

@@ -1,6 +1,6 @@
 import { a as resolveCodexPrivateLauncher, n as isCodexAppServerProxyLaunch } from "./launch-args-DbFCehO7.mjs";
 import { n as resolveCodexAppServerSpawnEnv, r as resolveCodexAppServerSpawnInvocation } from "./transport-stdio-lgeKKHyw.mjs";
-import { t as resolveCodexDoctorStartOptions } from "./doctor-start-options-DedLaoqI.mjs";
+import { t as resolveCodexDoctorStartOptions } from "./doctor-start-options-C28ek2hD.mjs";
 import { runUtf8CommandWithTimeout } from "openclaw/plugin-sdk/process-runtime";
 import path from "node:path";
 import fs from "node:fs/promises";

package/dist/api.js

@@ -1,7 +1,7 @@
 import { i as resolveManagedCodexNativeCommand, s as CODEX_APP_SERVER_VERSION } from "./.setup/managed-binary-DwC9wxch.mjs";
-import { t as codexNativeProfileRecoveryHealthCheck } from "./.setup/auth-profile-health-oHizqgye.mjs";
+import { t as codexNativeProfileRecoveryHealthCheck } from "./.setup/auth-profile-health-B05o5BAm.mjs";
 import { n as findCodexAppServerSpawnError, t as describeCodexSpawnError } from "./.setup/spawn-error-CL3n6MAa.mjs";
-import { t as resolveCodexDoctorStartOptions } from "./.setup/doctor-start-options-DedLaoqI.mjs";
+import { t as resolveCodexDoctorStartOptions } from "./.setup/doctor-start-options-C28ek2hD.mjs";
 import { runUtf8CommandWithTimeout } from "openclaw/plugin-sdk/process-runtime";
 import path from "node:path";
 import { coerceErrorMessage } from "openclaw/plugin-sdk/error-runtime";
@@ -115,7 +115,7 @@ function registerCodexManagedAppServerDoctorChecks$1(host, deps) {
 const CODEX_PLUGIN_ROOT = path.dirname(fileURLToPath(import.meta.url));
 async function probeCodexWorkspaceWriteSandbox(params) {
 	try {
-		const { probeCodexWorkspaceWriteSandbox: probe } = await import("./.setup/workspace-write-sandbox-probe-Cyn6cBsp.mjs");
+		const { probeCodexWorkspaceWriteSandbox: probe } = await import("./.setup/workspace-write-sandbox-probe-DvfWTvuR.mjs");
 		return await probe({
 			...params,
 			pluginRoot: CODEX_PLUGIN_ROOT