@openclaw/codex 2026.10.5 → 2026.10.7

package/dist/.setup/{settled-turn-finalizer-Blsc4VLX.mjs → settled-turn-finalizer-CnIWbqN7.mjs}

@@ -1,10 +1,10 @@
 import { i as readMirrorIdentity, n as attachCodexMirrorIdentity } from "./upstream-prompt-provenance-Ccd9MFRJ.mjs";
 import { l as readCodexMirrorSourceFingerprint, o as fingerprintCodexMirrorSourceMessage } from "./transcript-mirror-attestation-BzUXnrvv.mjs";
-import { nt as resolveCodexAppServerPreparedAuthHandoff } from "./shared-client-wb1JBldZ.mjs";
-import { f as assertCodexPassiveTurnItems } from "./client-BpSxNz4F.mjs";
-import { runBoundedCodexAppServerTurn } from "./bounded-turn-BpjZixcd.mjs";
+import { at as resolveCodexAppServerPreparedAuthHandoff } from "./shared-client-AdQX0Tdq.mjs";
+import { f as assertCodexPassiveTurnItems } from "./client-BM97zH3z.mjs";
+import { runBoundedCodexAppServerTurn } from "./bounded-turn-s9yVsxaM.mjs";
 import { t as resolveCodexLocalRuntimeAttribution } from "./local-runtime-attribution-CZz2DJ4q.mjs";
-import { t as resolveCodexBoundedTurnIsolation } from "./bounded-turn-isolation-Brj5qzz6.mjs";
+import { t as resolveCodexBoundedTurnIsolation } from "./bounded-turn-isolation-CIQJykuM.mjs";
 import { a as createAttributedCodexAssistantMessage } from "./event-projector-assistant-message-CLMKN4x-.mjs";
 import { t as codexTranscriptMirrorRuntime } from "./transcript-mirror-DVEzdOs0.mjs";
 import { t as CodexSettledTurnContext } from "./settled-turn-context-BPL6D3RO.mjs";

package/dist/.setup/{shared-client-wb1JBldZ.mjs → shared-client-AdQX0Tdq.mjs}

@@ -1,22 +1,22 @@
 import { i as isJsonObject } from "./protocol-CANUwXJ3.mjs";
-import { n as defineCodexBuildState, t as codexBuildSymbol } from "./build-state-DfrctLQv.mjs";
+import { n as defineCodexBuildState, t as codexBuildSymbol } from "./build-state-B5mKL-in.mjs";
 import { t as CODEX_APP_SERVER_AUTH_PROVIDER } from "./auth-profile-selection-hr8ocLtz.mjs";
 import { n as isCodexAppServerProxyLaunch } from "./launch-args-DbFCehO7.mjs";
 import { a as withEphemeralCodexAuthStore, i as withClearedEnvironmentVariables, n as resolveCodexAppServerLocalHomeDir, r as resolveCodexAppServerUserHomeDir, t as resolveCodexAppServerHomeDir } from "./auth-start-options-BPIPeEX8.mjs";
-import { a as resolveCodexAppServerStartOptionsForAgent, d as readCodexEffectiveConfig, o as resolveCodexComputerUseConfig, t as codexAppServerStartOptionsKey, u as CODEX_SESSION_OVERRIDABLE_LAYER_TYPES } from "./config-options-nvYwVDyy.mjs";
+import { a as resolveCodexAppServerStartOptionsForAgent, d as readCodexEffectiveConfig, o as resolveCodexComputerUseConfig, t as codexAppServerStartOptionsKey, u as CODEX_SESSION_OVERRIDABLE_LAYER_TYPES } from "./config-options-CZmH25Xq.mjs";
 import { d as resolveMacOSDesktopCodexBundledMarketplaceCandidates, f as resolveMacOSDesktopCodexComputerUseServiceAppCandidates, i as resolveManagedCodexNativeCommand, l as resolveFirstExistingMacOSDesktopCodexBundledMarketplacePath, r as resolveManagedCodexAppServerStartOptions, t as isManagedCodexDesktopCommand, u as resolveMacOSDesktopCodexAppPathCandidates } from "./managed-binary-DwC9wxch.mjs";
-import { A as waitForCodexDesktopGeneration, C as retirePendingSharedClientEntryIfUnclaimed, D as waitForUnclaimedSharedClientStartup, _ as observeSharedClientAcquire, a as readCodexCliAuthFileApiKey, b as releaseSharedClientEntry, c as resolveCodexAppServerPreparedApiKeyCacheKey, d as getCurrentSharedClientEntry, f as getOrCreateSharedClientEntry, g as observeAcquire, h as notifyDesktopGenerationDrainChecks, i as fingerprintTokenAuthProfileCacheKey, j as readCodexDesktopArtifactTreeFingerprint, k as isCodexDesktopGenerationCurrent, l as closeSharedClientEntryIfUnclaimed, n as CODEX_AUTH_JSON_FILENAME, o as readFirstNonEmptyEnv, p as getSharedCodexAppServerClientState, r as fingerprintApiKeyAuthProfileCacheKey, s as resolveCodexAppServerFallbackApiKeyCacheKey, t as CODEX_APP_SERVER_API_KEY_ENV_VARS, u as createCodexAppServerStartupLifetime, v as ownCodexStartup, w as retireSharedCodexAppServerClientIfCurrent, x as retainSharedClientEntry, y as recordSharedClientAcquireBoundary } from "./auth-cache-key-DvDLHVJe.mjs";
+import { A as waitForCodexDesktopGeneration, C as retirePendingSharedClientEntryIfUnclaimed, D as waitForUnclaimedSharedClientStartup, _ as observeSharedClientAcquire, a as readCodexCliAuthFileApiKey, b as releaseSharedClientEntry, c as resolveCodexAppServerPreparedApiKeyCacheKey, d as getCurrentSharedClientEntry, f as getOrCreateSharedClientEntry, g as observeAcquire, h as notifyDesktopGenerationDrainChecks, i as fingerprintTokenAuthProfileCacheKey, j as readCodexDesktopArtifactTreeFingerprint, k as isCodexDesktopGenerationCurrent, l as closeSharedClientEntryIfUnclaimed, n as CODEX_AUTH_JSON_FILENAME, o as readFirstNonEmptyEnv, p as getSharedCodexAppServerClientState, r as fingerprintApiKeyAuthProfileCacheKey, s as resolveCodexAppServerFallbackApiKeyCacheKey, t as CODEX_APP_SERVER_API_KEY_ENV_VARS, u as createCodexAppServerStartupLifetime, v as ownCodexStartup, w as retireSharedCodexAppServerClientIfCurrent, x as retainSharedClientEntry, y as recordSharedClientAcquireBoundary } from "./auth-cache-key-DrieYJUQ.mjs";
 import { n as resolveCodexAppServerSpawnEnv } from "./transport-stdio-lgeKKHyw.mjs";
 import { n as CodexAppServerAuthProfileUnavailableError, r as formatCodexAuthProfileUnavailableMessage } from "./auth-profile-recovery-BREezV0L.mjs";
 import { a as codexPrewriteRejectionCause } from "./rpc-error-C98SHchT.mjs";
 import { i as withTimeout } from "./timeout-D0mEWSGG.mjs";
 import { n as readCodexSessionMeta } from "./session-catalog-provenance-CmsOE5mh.mjs";
-import { n as observeCodexCatalogClient } from "./session-catalog-events-IoszcO7-.mjs";
-import { n as resolveCodexAppServerRuntimeOptions } from "./config-runtime-B8agjie6.mjs";
+import { n as observeCodexCatalogClient } from "./session-catalog-events-CpEyDv0D.mjs";
+import { n as resolveCodexAppServerRuntimeOptions } from "./config-runtime-DGB1-VbB.mjs";
 import { a as resolveCodexAppServerAuthProfileStore, i as resolveCodexAppServerAuthProfileIdForAgent, r as resolveCodexAppServerAuthProfileId, t as isCodexAppServerNativeAuthProfile } from "./auth-profile-CgHQ8Vot.mjs";
 import { i as isCodexResponsesOAuthCredential, n as createCodexResponsesOAuth, o as resolveCodexResponsesOAuthProfileFingerprint, r as isCodexResponsesOAuth, t as CODEX_RESPONSES_OAUTH_PROVIDER } from "./responses-oauth-twnuTaAa.mjs";
-import { N as isUnsupportedCodexAppServerVersionError, t as CodexAppServerClient } from "./client-BpSxNz4F.mjs";
-import { n as isCodexWebSocketOpenFailure } from "./transport-websocket-DOY0dJXN.mjs";
+import { N as isUnsupportedCodexAppServerVersionError, t as CodexAppServerClient } from "./client-BM97zH3z.mjs";
+import { n as isCodexWebSocketOpenFailure } from "./transport-websocket-CEBjEtFP.mjs";
 import { t as __exportAll } from "./session-binding-sidecars-DijNZb31.mjs";
 import { asOptionalRecord, isRecord } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { createHash, randomUUID } from "node:crypto";
@@ -1560,7 +1560,55 @@ function resolveExplicitChatgptAccountId(credential) {
 	return "accountId" in credential && typeof credential.accountId === "string" ? credential.accountId.trim() || void 0 : void 0;
 }
 //#endregion
+//#region extensions/codex/src/app-server/client-thread-closure.ts
+const MAX_CLOSED_THREAD_RECEIPTS = 256;
+const THREAD_TERMINAL_NOTIFICATION_METHODS = /* @__PURE__ */ new Set([
+	"thread/archived",
+	"thread/deleted",
+	"thread/closed"
+]);
+const closureState = defineCodexBuildState("openclaw.codexAppServerClosedThreads", () => ({
+	closedThreadsByClient: /* @__PURE__ */ new WeakMap(),
+	observedClients: /* @__PURE__ */ new WeakSet()
+}))();
+function recordCodexAppServerThreadClosed(client, threadId) {
+	const receipts = closureState.closedThreadsByClient.get(client) ?? /* @__PURE__ */ new Set();
+	receipts.delete(threadId);
+	receipts.add(threadId);
+	while (receipts.size > MAX_CLOSED_THREAD_RECEIPTS) {
+		const oldestThreadId = receipts.values().next().value;
+		if (oldestThreadId === void 0) break;
+		receipts.delete(oldestThreadId);
+	}
+	closureState.closedThreadsByClient.set(client, receipts);
+}
+function isCodexAppServerThreadTerminalNotification(method) {
+	return THREAD_TERMINAL_NOTIFICATION_METHODS.has(method);
+}
+function ensureCodexAppServerThreadClosureTracking(client) {
+	if (closureState.observedClients.has(client)) return;
+	closureState.observedClients.add(client);
+	client.addNotificationHandler((notification) => {
+		const threadId = notification.params && typeof notification.params === "object" ? Reflect.get(notification.params, "threadId") : void 0;
+		if (isCodexAppServerThreadTerminalNotification(notification.method) && typeof threadId === "string") recordCodexAppServerThreadClosed(client, threadId);
+	});
+	client.addCloseHandler(() => closureState.closedThreadsByClient.delete(client));
+}
+function clearCodexAppServerThreadClosed(client, threadId) {
+	closureState.closedThreadsByClient.get(client)?.delete(threadId);
+}
+function wasCodexAppServerThreadClosed(client, threadId) {
+	return closureState.closedThreadsByClient.get(client)?.has(threadId) === true;
+}
+//#endregion
 //#region extensions/codex/src/app-server/client-thread-owner.ts
+/** Background custody can survive projection replacement only under its creation policy. */
+function isThreadBackgroundOnly(runtime, threadId, configFingerprint) {
+	if (!runtime || runtime.closed || !runtime.protectedThreads.has(threadId)) return false;
+	const claim = runtime.claimedThreads.get(threadId);
+	const policy = claim?.configFingerprint ?? runtime.retainedThreads.get(threadId)?.configFingerprint;
+	return (!claim || claim.releaseAfterProtection !== void 0) && (configFingerprint === void 0 || policy === configFingerprint);
+}
 function createThreadOwnerToken(threadId, onInvalidated) {
 	const owner = {
 		invalidated: false,
@@ -1853,6 +1901,7 @@ function ensureCodexAppServerClientRuntime(client, context) {
 		workspaceReferences: /* @__PURE__ */ new Map()
 	};
 	configuredClients.set(client, runtime);
+	ensureCodexAppServerThreadClosureTracking(client);
 	client.addCloseHandler(() => {
 		runtime.closed = true;
 		clearTimeout(runtime.evictionTimer);
@@ -1928,7 +1977,7 @@ function scheduleRetainedThreadEviction(client, runtime) {
 		evictExpiredRetainedThreads(client, runtime).catch((error) => {
 			embeddedAgentLog$1.warn("codex retained thread expiry failed", { reason: formatErrorMessage$1(error) });
 		});
-	}, Math.max(0, expiresAt - Date.now()));
+	}, Math.max(0, Math.floor(expiresAt - performance.now())));
 	runtime.evictionTimer.unref?.();
 }
 async function releaseRetainedThread(client, runtime, threadId, assertCurrent, withCurrent) {
@@ -1962,7 +2011,7 @@ async function releaseRetainedThread(client, runtime, threadId, assertCurrent, w
 		return true;
 	} catch (error) {
 		if (!runtime.closed && !transition.invalidated && runtime.releasingThreads.get(threadId) === transition && !runtime.retainedThreads.has(threadId) && !runtime.claimedThreads.has(threadId)) {
-			if (retained.ephemeralPolicy === void 0) retained.expiresAt = Date.now() + CODEX_APP_SERVER_LIVE_THREAD_IDLE_TIMEOUT_MS;
+			if (retained.ephemeralPolicy === void 0) retained.expiresAt = performance.now() + CODEX_APP_SERVER_LIVE_THREAD_IDLE_TIMEOUT_MS;
 			const newerThreads = [...runtime.retainedThreads.entries()].filter(([candidateThreadId]) => !olderThreadIds.has(candidateThreadId));
 			for (const [candidateThreadId] of newerThreads) runtime.retainedThreads.delete(candidateThreadId);
 			runtime.retainedThreads.set(threadId, retained);
@@ -1975,7 +2024,7 @@ async function releaseRetainedThread(client, runtime, threadId, assertCurrent, w
 	}
 }
 async function evictExpiredRetainedThreads(client, runtime) {
-	const now = Date.now();
+	const now = performance.now();
 	for (const [threadId, thread] of runtime.retainedThreads) if (thread.expiresAt <= now && !runtime.protectedThreads.has(threadId)) await releaseRetainedThread(client, runtime, threadId);
 	scheduleRetainedThreadEviction(client, runtime);
 }
@@ -2000,13 +2049,14 @@ async function retainCodexAppServerLiveThread(client, threadId, releaseThread, c
 		return false;
 	}
 	const previousOwner = runtime.retainedThreads.get(threadId)?.ownerToken;
+	clearCodexAppServerThreadClosed(client, threadId);
 	runtime.retainedThreads.delete(threadId);
 	const retained = {
 		ownerToken,
 		configFingerprint,
 		ephemeralPolicy,
 		serviceTier,
-		expiresAt: ephemeralPolicy === void 0 ? Date.now() + CODEX_APP_SERVER_LIVE_THREAD_IDLE_TIMEOUT_MS : Number.POSITIVE_INFINITY,
+		expiresAt: ephemeralPolicy === void 0 ? performance.now() + CODEX_APP_SERVER_LIVE_THREAD_IDLE_TIMEOUT_MS : Number.POSITIVE_INFINITY,
 		release: (releaseThread ? physicalThreadReleases.get(releaseThread) ?? releaseThread : void 0) ?? defaultThreadRelease(client)
 	};
 	runtime.retainedThreads.set(threadId, retained);
@@ -2050,7 +2100,7 @@ async function claimCodexAppServerLiveThread(client, threadId, onInvalidated) {
 		return;
 	}
 	return claimCodexAppServerThreadOwnership(client, runtime, threadId, runtime.retainedThreads.get(threadId) ?? {
-		expiresAt: Date.now() + CODEX_APP_SERVER_LIVE_THREAD_IDLE_TIMEOUT_MS,
+		expiresAt: performance.now() + CODEX_APP_SERVER_LIVE_THREAD_IDLE_TIMEOUT_MS,
 		release: defaultThreadRelease(client)
 	}, onInvalidated);
 }
@@ -2058,6 +2108,7 @@ function claimCodexAppServerThreadOwnership(client, runtime, threadId, retained,
 	const previousClaim = runtime.claimedThreads.get(threadId);
 	runtime.retainedThreads.delete(threadId);
 	const claimed = createThreadOwnerToken(threadId, onInvalidated);
+	claimed.configFingerprint = retained.configFingerprint;
 	runtime.claimedThreads.set(threadId, claimed);
 	previousClaim?.invalidate();
 	retained.ownerToken?.invalidate();
@@ -2137,6 +2188,10 @@ function isCodexAppServerLiveThreadClaimed(client, threadId) {
 	const runtime = configuredClients.get(client);
 	return runtime !== void 0 && !runtime.closed && runtime.claimedThreads.has(threadId);
 }
+/** Completed foreground work may leave cleanup custody with native background work. */
+function isCodexAppServerLiveThreadBackgroundOnly(client, threadId, configFingerprint) {
+	return isThreadBackgroundOnly(configuredClients.get(client), threadId, configFingerprint);
+}
 /** Native commands and children can still need an otherwise-idle subscription. */
 function isCodexAppServerLiveThreadProtected(client, threadId) {
 	const runtime = configuredClients.get(client);
@@ -2213,7 +2268,7 @@ function protectCodexAppServerLiveThread(client, threadId) {
 		if (releaseThreadProtection(runtime, threadId)) {
 			const retained = runtime.retainedThreads.get(threadId);
 			if (retained) {
-				if (retained.ephemeralPolicy === void 0) retained.expiresAt = Date.now() + CODEX_APP_SERVER_LIVE_THREAD_IDLE_TIMEOUT_MS;
+				if (retained.ephemeralPolicy === void 0) retained.expiresAt = performance.now() + CODEX_APP_SERVER_LIVE_THREAD_IDLE_TIMEOUT_MS;
 				runtime.retainedThreads.delete(threadId);
 				runtime.retainedThreads.set(threadId, retained);
 			}
@@ -2485,8 +2540,8 @@ async function prepareCodexInferenceRoute(params) {
 				throw new Error("Codex inference route limit reached; start a fresh managed native connection before retrying.");
 			}
 			pending = Promise.all([
-				import("./inference-proxy-BDWV0djM.mjs"),
-				import("./native-subagent-monitor-gqu3TQOv.mjs").then((n) => n.n),
+				import("./inference-proxy-DSnaS-uS.mjs"),
+				import("./native-subagent-monitor-CJaIve3h.mjs").then((n) => n.n),
 				import("./inference-dispatch-CO6tTs4q.mjs")
 			]).then(([{ createCodexInferenceProxy }, native, { createCodexInferenceModelBinding }]) => {
 				assertClient();
@@ -3301,7 +3356,7 @@ async function startInitializedCodexAppServerClientOnce(params) {
 		} finally {
 			artifactDrain?.cancel();
 		}
-		const runtimeArtifactModule = params.runtimeArtifactMode ? await import("./runtime-artifact-nFHy1R0x.mjs") : void 0;
+		const runtimeArtifactModule = params.runtimeArtifactMode ? await import("./runtime-artifact-CCPLKFGR.mjs") : void 0;
 		const runtimeArtifactBeforeStart = runtimeArtifactModule ? await runtimeArtifactModule.captureCodexAppServerRuntimeArtifactBeforeStart({
 			startOptions,
 			spawnIdentity: resolveCodexAppServerSpawnIdentity(startOptions),
@@ -3555,4 +3610,4 @@ function clearSharedCodexAppServerClientIfCurrentAndUnclaimed(client) {
 	};
 }
 //#endregion
-export { createCodexEphemeralThreadPolicy as $, bindCodexInferenceThread as A, isCodexAppServerClientRuntimeLive as B, CodexThreadBindingConflictError as C, nativeHookRelayUnregisterQueue as D, isCodexContextRestartSelectionChangedError as E, consumeCodexAppServerLiveThread as F, readCodexClientSessionMeta as G, isCodexAppServerLiveThreadProtected as H, ensureCodexAppServerClientRuntime as I, revertCodexAppServerLiveThreadInstructions as J, releaseCodexAppServerLiveThread as K, forgetCodexWorkspaceReferences as L, getCodexInferenceThreadQualification as M, prepareCodexInferenceThreadConfig as N, acquireCodexNativeConfigFence as O, claimCodexAppServerLiveThread as P, rememberCodexRateLimitsRead as Q, hasCodexAppServerLiveThread as R, CodexAdoptedThreadActiveError as S, CodexThreadStartRequestError as T, prepareCodexWorkspaceReferences as U, isCodexAppServerLiveThreadClaimed as V, protectCodexAppServerLiveThread as W, readCodexRateLimitsRevision as X, unsubscribeCodexAppServerLiveThread as Y, readRecentCodexRateLimits as Z, retainSharedCodexAppServerClientIfCurrent as _, clearSharedCodexAppServerClientIfCurrentAndUnclaimed as a, hasLegacyCodexComputerUseMcpPolicy as at, withLeasedCodexAppServerClientStartSelectionRetry as b, getLeasedSharedCodexAppServerClient as c, ensureCodexComputerUseSharedPluginCache as ct, readCodexAppServerClientDesktopGeneration as d, TURN_FINALIZE_DRAIN_ABORT_GRACE_MS as dt, reconcileCodexComputerUseStartArtifacts as et, readCodexAppServerClientDesktopGenerationFingerprint as f, TURN_TERMINAL_SETTLEMENT_TIMEOUT_MS as ft, resolveCodexNativeConfigFenceKey as g, withCodexStartupTimeout as gt, releaseLeasedSharedCodexAppServerClient as h, resolveCodexStartupTimeoutMs as ht, clearSharedCodexAppServerClientIfCurrent as i, resolveClientManagedBundledMarketplacePath as it, getCodexInferenceThread as j, assertCodexInferenceRouteConfig as k, getSharedCodexAppServerClient as l, assertNotSymlink as lt, releaseCodexAppServerClientLease as m, resolveCodexGatewayTimeoutWithGraceMs as mt, captureCodexAppServerClientLifetime as n, resolveCodexAppServerPreparedAuthHandoff as nt, clearSharedCodexAppServerClientIfCurrentAndWait as o, isLegacyCodexComputerUsePluginDisabled as ot, readCodexAppServerClientProcessIdentity as p, isCodexAppServerStartupError as pt, retainCodexAppServerLiveThread as q, captureSharedCodexAppServerCatalogLifetime as r, resolveBundledComputerUseMarketplacePath as rt, createIsolatedCodexAppServerClient as s, resolveManagedCodexComputerUseConfig as st, assertCodexAppServerClientStartSelectionCurrent as t, resolveCodexAppServerAuthAccountCacheKey as tt, isCodexAppServerStartSelectionChangedError as u, CodexAppServerStartupError as ut, shared_client_exports as v, CodexThreadClientReplacementError as w, CODEX_APP_SERVER_CONTEXT_RESTART_SELECTION_CHANGED as x, waitForCodexAppServerClientDesktopGenerationDrain as y, hasCodexAppServerSiblingThreadWork as z };
+export { rememberCodexRateLimitsRead as $, bindCodexInferenceThread as A, isCodexAppServerClientRuntimeLive as B, CodexThreadBindingConflictError as C, nativeHookRelayUnregisterQueue as D, isCodexContextRestartSelectionChangedError as E, consumeCodexAppServerLiveThread as F, protectCodexAppServerLiveThread as G, isCodexAppServerLiveThreadClaimed as H, ensureCodexAppServerClientRuntime as I, retainCodexAppServerLiveThread as J, readCodexClientSessionMeta as K, forgetCodexWorkspaceReferences as L, getCodexInferenceThreadQualification as M, prepareCodexInferenceThreadConfig as N, acquireCodexNativeConfigFence as O, claimCodexAppServerLiveThread as P, readRecentCodexRateLimits as Q, hasCodexAppServerLiveThread as R, CodexAdoptedThreadActiveError as S, CodexThreadStartRequestError as T, isCodexAppServerLiveThreadProtected as U, isCodexAppServerLiveThreadBackgroundOnly as V, prepareCodexWorkspaceReferences as W, unsubscribeCodexAppServerLiveThread as X, revertCodexAppServerLiveThreadInstructions as Y, readCodexRateLimitsRevision as Z, retainSharedCodexAppServerClientIfCurrent as _, resolveCodexGatewayTimeoutWithGraceMs as _t, clearSharedCodexAppServerClientIfCurrentAndUnclaimed as a, resolveCodexAppServerPreparedAuthHandoff as at, withLeasedCodexAppServerClientStartSelectionRetry as b, getLeasedSharedCodexAppServerClient as c, hasLegacyCodexComputerUseMcpPolicy as ct, readCodexAppServerClientDesktopGeneration as d, ensureCodexComputerUseSharedPluginCache as dt, createCodexEphemeralThreadPolicy as et, readCodexAppServerClientDesktopGenerationFingerprint as f, assertNotSymlink as ft, resolveCodexNativeConfigFenceKey as g, isCodexAppServerStartupError as gt, releaseLeasedSharedCodexAppServerClient as h, TURN_TERMINAL_SETTLEMENT_TIMEOUT_MS as ht, clearSharedCodexAppServerClientIfCurrent as i, resolveCodexAppServerAuthAccountCacheKey as it, getCodexInferenceThread as j, assertCodexInferenceRouteConfig as k, getSharedCodexAppServerClient as l, isLegacyCodexComputerUsePluginDisabled as lt, releaseCodexAppServerClientLease as m, TURN_FINALIZE_DRAIN_ABORT_GRACE_MS as mt, captureCodexAppServerClientLifetime as n, wasCodexAppServerThreadClosed as nt, clearSharedCodexAppServerClientIfCurrentAndWait as o, resolveBundledComputerUseMarketplacePath as ot, readCodexAppServerClientProcessIdentity as p, CodexAppServerStartupError as pt, releaseCodexAppServerLiveThread as q, captureSharedCodexAppServerCatalogLifetime as r, reconcileCodexComputerUseStartArtifacts as rt, createIsolatedCodexAppServerClient as s, resolveClientManagedBundledMarketplacePath as st, assertCodexAppServerClientStartSelectionCurrent as t, isCodexAppServerThreadTerminalNotification as tt, isCodexAppServerStartSelectionChangedError as u, resolveManagedCodexComputerUseConfig as ut, shared_client_exports as v, resolveCodexStartupTimeoutMs as vt, CodexThreadClientReplacementError as w, CODEX_APP_SERVER_CONTEXT_RESTART_SELECTION_CHANGED as x, waitForCodexAppServerClientDesktopGenerationDrain as y, withCodexStartupTimeout as yt, hasCodexAppServerSiblingThreadWork as z };

package/dist/.setup/{side-question-DNEeROvz.mjs → side-question-ZVehuPZn.mjs}

@@ -1,29 +1,29 @@
 import { i as isJsonObject } from "./protocol-CANUwXJ3.mjs";
 import { m as sessionBindingIdentity } from "./session-binding-record-C2kDBZhx.mjs";
-import { c as withMcpElicitationsApprovalPolicy, d as readCodexRequirementsToml, n as hasCodexMcpToolApprovalOverrides, s as shouldAutoApproveCodexAppServerApprovals } from "./config-security-D0hAOQRI.mjs";
+import { c as withMcpElicitationsApprovalPolicy, d as readCodexRequirementsToml, n as hasCodexMcpToolApprovalOverrides, s as shouldAutoApproveCodexAppServerApprovals } from "./config-security-DpkGNy5T.mjs";
 import { c as isCodexPairedNodeRemoteExecPlacementSandbox, d as readCodexPluginConfig, l as isCodexRemoteExecPlacementSandbox, u as isCodexSandboxExecServerEnabled } from "./config-parsing-CVK2Q463.mjs";
-import { i as resolveCodexAppServerHomeScope, l as resolveCodexModelBackedReviewerPolicyContext } from "./config-options-nvYwVDyy.mjs";
+import { i as resolveCodexAppServerHomeScope, l as resolveCodexModelBackedReviewerPolicyContext } from "./config-options-CZmH25Xq.mjs";
 import { n as formatCodexUsageLimitErrorMessage } from "./rate-limits-CI8pTPqL.mjs";
-import { i as resolveCodexBindingAppServerConnection, r as requireCodexSupervisionModelSelection } from "./binding-connection-X1ZeEDz8.mjs";
-import { n as canUseCodexModelBackedApprovalsReviewerForModel, r as resolveOpenClawExecPolicyForCodexAppServer } from "./config-G4IGX6bK.mjs";
-import { Z as readRecentCodexRateLimits, b as withLeasedCodexAppServerClientStartSelectionRetry, c as getLeasedSharedCodexAppServerClient, m as releaseCodexAppServerClientLease, nt as resolveCodexAppServerPreparedAuthHandoff } from "./shared-client-wb1JBldZ.mjs";
-import { E as resolveDynamicToolCallTimeoutMs, O as toCodexDynamicToolProtocolResponse, T as handleDynamicToolCallWithTimeout, _ as assertCodexTurnStartResponse, a as isCodexAppServerIndeterminateRequestCancellationError, k as resolveCodexToolAbortTerminalReason, m as assertCodexThreadForkResponse, r as isCodexAppServerApprovalRequest, w as createCodexElicitationResponse, y as readCodexDynamicToolCallParams } from "./client-BpSxNz4F.mjs";
-import { d as terminateCodexBackgroundTerminals, f as unsubscribeCodexThreadBestEffort, l as retireUnsafeCodexTurnClientBestEffort, s as interruptCodexTurnAndWaitBestEffort } from "./attempt-client-cleanup-TScCVTsk.mjs";
-import { t as CodexEphemeralTurn } from "./ephemeral-turn-C6aFeGFS.mjs";
-import { d as mergeCodexThreadConfigs, f as refreshCodexPluginAppApprovalPolicy } from "./project-doc-thread-config-B2ZD23A_.mjs";
+import { i as resolveCodexBindingAppServerConnection, r as requireCodexSupervisionModelSelection } from "./binding-connection-C0t9TBX_.mjs";
+import { n as canUseCodexModelBackedApprovalsReviewerForModel, r as resolveOpenClawExecPolicyForCodexAppServer } from "./config-LQemoqTL.mjs";
+import { Q as readRecentCodexRateLimits, at as resolveCodexAppServerPreparedAuthHandoff, b as withLeasedCodexAppServerClientStartSelectionRetry, c as getLeasedSharedCodexAppServerClient, m as releaseCodexAppServerClientLease } from "./shared-client-AdQX0Tdq.mjs";
+import { E as resolveDynamicToolCallTimeoutMs, O as toCodexDynamicToolProtocolResponse, T as handleDynamicToolCallWithTimeout, _ as assertCodexTurnStartResponse, a as isCodexAppServerIndeterminateRequestCancellationError, k as resolveCodexToolAbortTerminalReason, m as assertCodexThreadForkResponse, r as isCodexAppServerApprovalRequest, w as createCodexElicitationResponse, y as readCodexDynamicToolCallParams } from "./client-BM97zH3z.mjs";
+import { d as terminateCodexBackgroundTerminals, f as unsubscribeCodexThreadBestEffort, l as retireUnsafeCodexTurnClientBestEffort, s as interruptCodexTurnAndWaitBestEffort } from "./attempt-client-cleanup-jWVRH043.mjs";
+import { t as CodexEphemeralTurn } from "./ephemeral-turn-DeppK8zz.mjs";
+import { d as mergeCodexThreadConfigs, f as refreshCodexPluginAppApprovalPolicy } from "./project-doc-thread-config-D_sWbxFR.mjs";
 import { n as resolveCodexAppServerReasoningEffort, t as readCodexSupportedReasoningEfforts } from "./reasoning-effort-CS9kKWB9.mjs";
-import { h as resolveCodexWebSearchPlan, r as buildCodexRuntimeThreadConfig, z as resolveCodexDynamicToolsLoading } from "./thread-requests-BqPhA4Gs.mjs";
+import { h as resolveCodexWebSearchPlan, r as buildCodexRuntimeThreadConfig, z as resolveCodexDynamicToolsLoading } from "./thread-requests-DjyDmCo4.mjs";
 import { i as resolveCodexSessionBinding } from "./session-binding-BDnNz-Co.mjs";
 import { i as resolveCodexAppServerThreadModelSelection, t as CODEX_NATIVE_PERSONALITY_NONE } from "./thread-model-selection-DcVebr8N.mjs";
 import { t as resolveCodexNativeExecutionBlock } from "./sandbox-guard-Cf9XMRrg.mjs";
-import { i as assertCodexSupervisionThreadLineage, n as CodexThreadPolicyHandoffError, o as refreshCodexThreadPolicy } from "./thread-policy-BMRvlOi-.mjs";
+import { i as assertCodexSupervisionThreadLineage, n as CodexThreadPolicyHandoffError, o as refreshCodexThreadPolicy } from "./thread-policy-Dp4CQjdL.mjs";
 import { o as runCodexCleanupStep } from "./run-attempt-lifecycle-DN-ATDp9.mjs";
-import { a as resolveCodexExternalSandboxPolicyForOpenClawSandbox, c as shouldEnableCodexAppServerNativeToolSurface, l as shouldRequireCodexSandboxExecServerEnvironment, o as resolveCodexMessageToolProvider, s as resolveCodexSandboxEnvironmentSelection, t as buildDynamicTools } from "./dynamic-tool-build-CoMf7IKx.mjs";
-import { a as buildCodexNativeHookRelayDisabledConfig, i as buildCodexNativeHookRelayConfig, l as resolveCodexNativeHookRelayEvents, u as resolveCodexNativeHookRelayTtlMs } from "./native-hook-relay-BQ9UkpeG.mjs";
-import { i as resolveCodexSessionPermissionCwd, n as applyCodexSessionPermissionPolicy, r as resolveCodexEffectiveSessionPermissionPolicy, t as CODEX_SESSION_PERMISSION_EXEC_MODES } from "./session-permission-policy-BYI6mp5u.mjs";
-import { a as handleCodexAppServerApprovalRequest, c as createCodexNativePreToolUseFailureBuffer, d as buildCodexTemporalAdditionalContext, g as buildCodexUserInput, i as createCodexDynamicToolDiagnostics, o as ensureCodexSandboxExecServerEnvironment, r as routeCodexAppServerElicitationRequest, s as releaseCodexSandboxExecServerEnvironment, t as createCodexDynamicToolBridge, y as CodexNativeToolLifecycleProjector } from "./dynamic-tools-CKynHtxM.mjs";
-import { t as resolveCodexAppServerForModelProvider } from "./app-server-policy-XTIa6h5k.mjs";
-import { n as resolveCodexProviderWebSearchSupportForClient } from "./provider-capabilities-DOBUBt86.mjs";
+import { a as resolveCodexExternalSandboxPolicyForOpenClawSandbox, c as shouldEnableCodexAppServerNativeToolSurface, l as shouldRequireCodexSandboxExecServerEnvironment, o as resolveCodexMessageToolProvider, s as resolveCodexSandboxEnvironmentSelection, t as buildDynamicTools } from "./dynamic-tool-build-Dp4v52Kl.mjs";
+import { a as buildCodexNativeHookRelayDisabledConfig, i as buildCodexNativeHookRelayConfig, l as resolveCodexNativeHookRelayEvents, u as resolveCodexNativeHookRelayTtlMs } from "./native-hook-relay-Ctyky2Qt.mjs";
+import { i as resolveCodexSessionPermissionCwd, n as applyCodexSessionPermissionPolicy, r as resolveCodexEffectiveSessionPermissionPolicy, t as CODEX_SESSION_PERMISSION_EXEC_MODES } from "./session-permission-policy-C7kYxPGd.mjs";
+import { a as handleCodexAppServerApprovalRequest, c as createCodexNativePreToolUseFailureBuffer, d as buildCodexTemporalAdditionalContext, g as buildCodexUserInput, i as createCodexDynamicToolDiagnostics, o as ensureCodexSandboxExecServerEnvironment, r as routeCodexAppServerElicitationRequest, s as releaseCodexSandboxExecServerEnvironment, t as createCodexDynamicToolBridge, y as CodexNativeToolLifecycleProjector } from "./dynamic-tools-C1Egdhrx.mjs";
+import { t as resolveCodexAppServerForModelProvider } from "./app-server-policy-V8zuN8q_.mjs";
+import { n as resolveCodexProviderWebSearchSupportForClient } from "./provider-capabilities-BCZeV7xZ.mjs";
 import { readStringField } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { randomUUID } from "node:crypto";
 import { isDeepStrictEqual } from "node:util";

package/dist/.setup/{source-BjBw-zoV.mjs → source-BszpKEvi.mjs}

@@ -1,7 +1,7 @@
 import { a as defaultCodexAppInventoryCache, r as buildCodexPluginAppCacheKey } from "./plugin-app-cache-key-Bg9DbDI6.mjs";
-import { a as withCodexAppServerJsonClient } from "./request-DhbisYCc.mjs";
-import { a as marketplaceRef, o as pluginReadParams, r as isOpenAiCuratedMarketplaceName, u as CODEX_PLUGINS_MARKETPLACE_NAME } from "./plugin-inventory-kLR7G02h.mjs";
-import "./config-G4IGX6bK.mjs";
+import { a as withCodexAppServerJsonClient } from "./request-XC1RG34l.mjs";
+import { a as marketplaceRef, o as pluginReadParams, r as isOpenAiCuratedMarketplaceName, u as CODEX_PLUGINS_MARKETPLACE_NAME } from "./plugin-inventory-OhiCoyPH.mjs";
+import "./config-LQemoqTL.mjs";
 import { t as __exportAll } from "./session-binding-sidecars-DijNZb31.mjs";
 import { asNonArrayRecord } from "openclaw/plugin-sdk/string-coerce-runtime";
 import path from "node:path";

package/dist/.setup/{thread-lifecycle-run-DdwKMIae.mjs → thread-lifecycle-run-DezS4UNT.mjs}

@@ -1,11 +1,11 @@
 import { i as isJsonObject, r as flattenCodexDynamicToolFunctions } from "./protocol-CANUwXJ3.mjs";
 import { n as matchesPendingSupervisionBranch } from "./session-binding-record-codec-CWQXr9os.mjs";
 import { m as sessionBindingIdentity, n as assertCodexBindingMayBeReplaced } from "./session-binding-record-C2kDBZhx.mjs";
-import { l as fingerprintCodexPolicy } from "./config-security-D0hAOQRI.mjs";
+import { l as fingerprintCodexPolicy } from "./config-security-DpkGNy5T.mjs";
 import { f as resolveCodexPluginsPolicy } from "./config-parsing-CVK2Q463.mjs";
 import { n as resolveCodexAppServerLocalHomeDir, t as resolveCodexAppServerHomeDir } from "./auth-start-options-BPIPeEX8.mjs";
-import { d as readCodexEffectiveConfig, s as assertCodexModelBackedReviewerEffectiveConfig, u as CODEX_SESSION_OVERRIDABLE_LAYER_TYPES } from "./config-options-nvYwVDyy.mjs";
-import { S as retainSharedCodexAppServerClientByInstanceId, d as getCurrentSharedClientEntry } from "./auth-cache-key-DvDLHVJe.mjs";
+import { d as readCodexEffectiveConfig, s as assertCodexModelBackedReviewerEffectiveConfig, u as CODEX_SESSION_OVERRIDABLE_LAYER_TYPES } from "./config-options-CZmH25Xq.mjs";
+import { S as retainSharedCodexAppServerClientByInstanceId, d as getCurrentSharedClientEntry } from "./auth-cache-key-DrieYJUQ.mjs";
 import { t as withCodexAppServerThreadMutation } from "./thread-ownership-queue-CeyYScUC.mjs";
 import { o as isCodexAppServerOverloadError, r as CodexAppServerRpcError, s as isCodexThreadReadMissingError } from "./rpc-error-C98SHchT.mjs";
 import { t as codexCatalogHomeId } from "./session-catalog-home-id-vlih0B_g.mjs";
@@ -13,34 +13,34 @@ import { r as withAbortableTimeout } from "./timeout-D0mEWSGG.mjs";
 import { t as projectBoundedCodexThreadHistory } from "./transcript-history-projection-DfKcoZCB.mjs";
 import { a as defaultCodexAppInventoryCache, t as buildCodexAppServerConnectionFingerprint } from "./plugin-app-cache-key-Bg9DbDI6.mjs";
 import { n as readCodexSessionMeta } from "./session-catalog-provenance-CmsOE5mh.mjs";
-import { t as assertCodexSessionRuntimeOwnership } from "./binding-connection-X1ZeEDz8.mjs";
-import { c as resolveRecoverableCodexPluginConfigKeys } from "./plugin-inventory-kLR7G02h.mjs";
-import "./config-G4IGX6bK.mjs";
+import { t as assertCodexSessionRuntimeOwnership } from "./binding-connection-C0t9TBX_.mjs";
+import { c as resolveRecoverableCodexPluginConfigKeys } from "./plugin-inventory-OhiCoyPH.mjs";
+import "./config-LQemoqTL.mjs";
 import { c as resolveCodexContextEngineProjectionMaxChars } from "./context-engine-projection-ps-yn_ci.mjs";
 import { n as normalizeCodexAppServerBindingModelProvider } from "./auth-profile-CgHQ8Vot.mjs";
-import { $ as createCodexEphemeralThreadPolicy, A as bindCodexInferenceThread, B as isCodexAppServerClientRuntimeLive, C as CodexThreadBindingConflictError, F as consumeCodexAppServerLiveThread, H as isCodexAppServerLiveThreadProtected, K as releaseCodexAppServerLiveThread, M as getCodexInferenceThreadQualification, N as prepareCodexInferenceThreadConfig, S as CodexAdoptedThreadActiveError, T as CodexThreadStartRequestError, V as isCodexAppServerLiveThreadClaimed, Y as unsubscribeCodexAppServerLiveThread, j as getCodexInferenceThread, k as assertCodexInferenceRouteConfig, n as captureCodexAppServerClientLifetime, w as CodexThreadClientReplacementError, z as hasCodexAppServerSiblingThreadWork } from "./shared-client-wb1JBldZ.mjs";
-import { C as resolveCodexThreadRolloutPath, F as getCodexAppServerClientInstanceId, L as resolveCodexAppServerClientInstanceId, S as readSupervisionResponseThreadId, c as isCodexAppServerRequestTimeoutError, g as assertCodexThreadStartResponse, m as assertCodexThreadForkResponse, p as assertCodexThreadAcceptsDirectInput, v as assertExactSupervisionModelSelection } from "./client-BpSxNz4F.mjs";
-import { r as hasCodexAppServerSiblingRouteWork } from "./turn-router-DdlzuFdm.mjs";
-import { f as unsubscribeCodexThreadBestEffort, l as retireUnsafeCodexTurnClientBestEffort, n as CODEX_APP_SERVER_UNSUBSCRIBE_TIMEOUT_MS, o as closeCodexStartupClientBestEffort, r as CodexAppServerUnsafeSubscriptionError } from "./attempt-client-cleanup-TScCVTsk.mjs";
-import { a as buildCodexPluginThreadConfigInputFingerprint, c as buildPluginAppPolicyContext, d as mergeCodexThreadConfigs, i as buildCodexPluginThreadConfig, l as disableUnlistedCodexApps, m as buildCodexAppApprovalOverrides, n as mergeCodexNativeProjectDocThreadConfig, o as buildCodexPluginThreadConfigTimeoutFallback, p as shouldBuildCodexPluginThreadConfig, r as buildCodexPluginAppsConfigPatchFromPolicyContext, u as isCodexPluginThreadBindingStale } from "./project-doc-thread-config-B2ZD23A_.mjs";
-import { A as isTransientWebSearchRestriction, C as fingerprintEnvironmentSelection, D as readActiveCodexTurnIdsFromResume, E as legacyFingerprintUserMcpServersConfigPatch, I as isMessageOnlyCodexSourceReply, L as isSystemAgentOnlyCodexDynamicToolAllowlist, M as shouldRotateCodexAppServerBindingForRuntime, N as shouldRotateCodexGpt56MultiAgentBinding, O as shouldStartTransientNoToolThread, S as fingerprintCodexThreadConfig, T as fingerprintUserMcpServersConfigPatch, _ as buildDeveloperInstructions, b as codexDynamicToolsFingerprint, c as codexThreadSandboxOrPermissions, d as readCodexManagedRequirementsFingerprint, f as resolveCodexThreadApprovalsReviewer, g as mergeCodexNativeShellEnvironment, h as resolveCodexWebSearchPlan, i as buildCodexRuntimeThreadConfigForRun, j as shouldRecheckRecoverablePluginBinding, n as buildCodexRingZeroThreadConfigPatch, o as buildThreadResumeParams, p as attestCodexRestrictedToolSurfaceMcpServersDisabled, s as buildThreadStartParams, t as assertCodexManagedRequirementsDoNotOverrideToolPolicy, u as readCodexInheritedMcpServerNames, v as areCodexDynamicToolFingerprintsCompatible, w as fingerprintJsonObject, x as codexLegacyDynamicToolsFingerprint, y as areUserMcpServersFingerprintsCompatible } from "./thread-requests-BqPhA4Gs.mjs";
+import { A as bindCodexInferenceThread, B as isCodexAppServerClientRuntimeLive, C as CodexThreadBindingConflictError, F as consumeCodexAppServerLiveThread, H as isCodexAppServerLiveThreadClaimed, M as getCodexInferenceThreadQualification, N as prepareCodexInferenceThreadConfig, S as CodexAdoptedThreadActiveError, T as CodexThreadStartRequestError, U as isCodexAppServerLiveThreadProtected, V as isCodexAppServerLiveThreadBackgroundOnly, X as unsubscribeCodexAppServerLiveThread, et as createCodexEphemeralThreadPolicy, j as getCodexInferenceThread, k as assertCodexInferenceRouteConfig, n as captureCodexAppServerClientLifetime, nt as wasCodexAppServerThreadClosed, q as releaseCodexAppServerLiveThread, tt as isCodexAppServerThreadTerminalNotification, w as CodexThreadClientReplacementError, z as hasCodexAppServerSiblingThreadWork } from "./shared-client-AdQX0Tdq.mjs";
+import { C as resolveCodexThreadRolloutPath, F as getCodexAppServerClientInstanceId, L as resolveCodexAppServerClientInstanceId, S as readSupervisionResponseThreadId, c as isCodexAppServerRequestTimeoutError, g as assertCodexThreadStartResponse, m as assertCodexThreadForkResponse, p as assertCodexThreadAcceptsDirectInput, v as assertExactSupervisionModelSelection } from "./client-BM97zH3z.mjs";
+import { r as hasCodexAppServerSiblingRouteWork } from "./turn-router-DnfbVPvu.mjs";
+import { f as unsubscribeCodexThreadBestEffort, l as retireUnsafeCodexTurnClientBestEffort, n as CODEX_APP_SERVER_UNSUBSCRIBE_TIMEOUT_MS, o as closeCodexStartupClientBestEffort, r as CodexAppServerUnsafeSubscriptionError } from "./attempt-client-cleanup-jWVRH043.mjs";
+import { a as buildCodexPluginThreadConfigInputFingerprint, c as buildPluginAppPolicyContext, d as mergeCodexThreadConfigs, i as buildCodexPluginThreadConfig, l as disableUnlistedCodexApps, m as buildCodexAppApprovalOverrides, n as mergeCodexNativeProjectDocThreadConfig, o as buildCodexPluginThreadConfigTimeoutFallback, p as shouldBuildCodexPluginThreadConfig, r as buildCodexPluginAppsConfigPatchFromPolicyContext, u as isCodexPluginThreadBindingStale } from "./project-doc-thread-config-D_sWbxFR.mjs";
+import { A as isTransientWebSearchRestriction, C as fingerprintEnvironmentSelection, D as readActiveCodexTurnIdsFromResume, E as legacyFingerprintUserMcpServersConfigPatch, I as isMessageOnlyCodexSourceReply, L as isSystemAgentOnlyCodexDynamicToolAllowlist, M as shouldRotateCodexAppServerBindingForRuntime, N as shouldRotateCodexGpt56MultiAgentBinding, O as shouldStartTransientNoToolThread, S as fingerprintCodexThreadConfig, T as fingerprintUserMcpServersConfigPatch, _ as buildDeveloperInstructions, b as codexDynamicToolsFingerprint, c as codexThreadSandboxOrPermissions, d as readCodexManagedRequirementsFingerprint, f as resolveCodexThreadApprovalsReviewer, g as mergeCodexNativeShellEnvironment, h as resolveCodexWebSearchPlan, i as buildCodexRuntimeThreadConfigForRun, j as shouldRecheckRecoverablePluginBinding, n as buildCodexRingZeroThreadConfigPatch, o as buildThreadResumeParams, p as attestCodexRestrictedToolSurfaceMcpServersDisabled, s as buildThreadStartParams, t as assertCodexManagedRequirementsDoNotOverrideToolPolicy, u as readCodexInheritedMcpServerNames, v as areCodexDynamicToolFingerprintsCompatible, w as fingerprintJsonObject, x as codexLegacyDynamicToolsFingerprint, y as areUserMcpServersFingerprintsCompatible } from "./thread-requests-DjyDmCo4.mjs";
 import { i as resolveCodexSessionBinding, o as hashCodexAppServerBindingFingerprint } from "./session-binding-BDnNz-Co.mjs";
 import { i as resolveCodexAppServerThreadModelSelection, n as resolveCodexAppServerModelProvider } from "./thread-model-selection-DcVebr8N.mjs";
-import { c as withExclusiveCodexAppServerThread, r as retainCodexAppServerBindingSubscription, t as isSameCodexAppServerThreadOwner } from "./thread-ownership-CTUs8Eyu.mjs";
-import { a as refreshCodexThreadInstructions, i as assertCodexSupervisionThreadLineage, n as CodexThreadPolicyHandoffError, o as refreshCodexThreadPolicy, r as assertAdoptedCodexThreadResumeAllowed, t as CodexIncognitoPolicyChangeError } from "./thread-policy-BMRvlOi-.mjs";
-import { t as resumeCodexAppServerThread } from "./thread-resume-CD48Vab8.mjs";
+import { c as withExclusiveCodexAppServerThread, r as retainCodexAppServerBindingSubscription, t as isSameCodexAppServerThreadOwner } from "./thread-ownership-OXzPB_RV.mjs";
+import { a as refreshCodexThreadInstructions, i as assertCodexSupervisionThreadLineage, n as CodexThreadPolicyHandoffError, o as refreshCodexThreadPolicy, r as assertAdoptedCodexThreadResumeAllowed, t as CodexIncognitoPolicyChangeError } from "./thread-policy-Dp4CQjdL.mjs";
+import { t as resumeCodexAppServerThread } from "./thread-resume-8YKfRoX6.mjs";
 import { r as readCodexMcpToolConnectorId } from "./mcp-tool-metadata-_sawBkIh.mjs";
-import { n as disableCodexPluginThreadConfig } from "./dynamic-tool-build-CoMf7IKx.mjs";
-import { n as CodexManagedHooksOnlyError, r as assertCodexNativeHookRelayAllowed } from "./native-hook-relay-BQ9UkpeG.mjs";
+import { n as disableCodexPluginThreadConfig } from "./dynamic-tool-build-Dp4v52Kl.mjs";
+import { n as CodexManagedHooksOnlyError, r as assertCodexNativeHookRelayAllowed } from "./native-hook-relay-Ctyky2Qt.mjs";
 import { t as defaultCodexPluginMetadataCache } from "./plugin-metadata-cache-Bi8TAPwX.mjs";
-import { a as discardUnattestedCodexPluginThread, i as checkCodexThreadAppAvailability, n as resolveCodexNativeSkillIsolation, o as hasCodexNativeToolCatalog, r as attestCodexThreadToolSurface, s as loadCodexNativeToolCatalog, t as applyCodexNativeSkillIsolation } from "./native-skill-isolation-CxZRtiWZ.mjs";
+import { a as discardUnattestedCodexPluginThread, i as checkCodexThreadAppAvailability, n as resolveCodexNativeSkillIsolation, o as hasCodexNativeToolCatalog, r as attestCodexThreadToolSurface, s as loadCodexNativeToolCatalog, t as applyCodexNativeSkillIsolation } from "./native-skill-isolation-C4XYLm33.mjs";
 import { asOptionalRecord, normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
 import crypto from "node:crypto";
 import { isDeepStrictEqual } from "node:util";
 import { resolveSessionAgentIdsStrict } from "openclaw/plugin-sdk/agent-scope-runtime";
 import path from "node:path";
-import { isIncognitoSessionKey } from "openclaw/plugin-sdk/session-key-runtime";
 import { createStageTimingTracker, formatStageTimings, racePromiseWithAbortSignal } from "openclaw/plugin-sdk/time-runtime";
+import { isIncognitoSessionKey } from "openclaw/plugin-sdk/session-key-runtime";
 import { resolveAgentDir as resolveAgentDir$1 } from "openclaw/plugin-sdk/agent-runtime";
 import { AgentHarnessPreflightError, embeddedAgentLog, formatErrorMessage, isActiveHarnessContextEngine, isHostScopedAgentToolActive } from "openclaw/plugin-sdk/agent-harness-runtime";
 import { buildCodexUserMcpServersThreadConfigPatchForRun } from "openclaw/plugin-sdk/codex-mcp-projection";
@@ -1216,9 +1216,23 @@ async function releaseCodexRetainedLiveThread(options) {
 /** Release follows the physical owner across connection rotation, never a copied thread id. */
 async function releaseCodexBoundLiveThread(options) {
 	const changedClient = options.ownerClientId && options.ownerClientId !== options.clientId;
-	const previous = changedClient ? await retainSharedCodexAppServerClientByInstanceId(options.ownerClientId) : void 0;
+	const previous = changedClient ? await retainSharedCodexAppServerClientByInstanceId(options.ownerClientId, {
+		signal: options.signal,
+		createAbortError: codexThreadLifecycleAbortError
+	}) : void 0;
 	if (changedClient && !previous) return false;
 	const client = previous?.client ?? options.client;
+	let threadClosed;
+	let stopWatching;
+	if (previous) {
+		threadClosed = new Promise((resolve) => {
+			stopWatching = client.addNotificationHandler((notification) => {
+				const threadId = notification.params && typeof notification.params === "object" ? Reflect.get(notification.params, "threadId") : void 0;
+				if (isCodexAppServerThreadTerminalNotification(notification.method) && threadId === options.threadId) resolve();
+			});
+		});
+		if (wasCodexAppServerThreadClosed(client, options.threadId)) threadClosed = Promise.resolve();
+	}
 	try {
 		if (isCodexAppServerLiveThreadClaimed(client, options.threadId) || isCodexAppServerLiveThreadProtected(client, options.threadId)) throw new Error(`Codex thread ${options.threadId} is claimed by active work; stop it first.`);
 		return await releaseCodexRetainedLiveThread({
@@ -1232,8 +1246,12 @@ async function releaseCodexBoundLiveThread(options) {
 			} : void 0
 		});
 	} finally {
-		const retiredExit = previous?.release(!isCodexAppServerLiveThreadClaimed(client, options.threadId) && !isCodexAppServerLiveThreadProtected(client, options.threadId));
-		if (retiredExit) await racePromiseWithAbortSignal(retiredExit, options.signal, codexThreadLifecycleAbortError);
+		try {
+			const retiredExit = previous?.release(!isCodexAppServerLiveThreadClaimed(client, options.threadId) && !isCodexAppServerLiveThreadProtected(client, options.threadId));
+			if (retiredExit) await options.lifecycleTiming.measure("retired-thread-runtime-release", () => racePromiseWithAbortSignal(threadClosed ? Promise.race([retiredExit, threadClosed]) : retiredExit, options.signal, codexThreadLifecycleAbortError));
+		} finally {
+			stopWatching?.();
+		}
 	}
 }
 /** Reuses one safely owned, fully matching subscription on its original client. */
@@ -1580,6 +1598,16 @@ function observeCodexThreadConfiguration(params, thread, assertCurrent) {
 	};
 }
 //#endregion
+//#region extensions/codex/src/app-server/thread-lifecycle-projection.ts
+/** Projection identity omits persistent instructions: qualify using warm reuse's full policy. */
+async function canRetainCodexProjectionBackgroundWork(params, binding, context, pluginThreadConfig) {
+	const finalConfig = await prepareCodexThreadFinalConfigPatch(params, context.nativeModelInputTools, binding);
+	const pluginConfig = pluginThreadConfig?.configPatch ?? (params.pluginThreadConfig?.enabled && binding.pluginAppPolicyContext ? buildCodexPluginAppsConfigPatchFromPolicyContext(binding.pluginAppPolicyContext) : void 0);
+	const authProfileId = binding.connectionScope === "supervision" ? void 0 : params.params.authProfileId ?? binding.authProfileId;
+	const resumeParams = context.buildResumeParams(binding, authProfileId, buildCodexThreadRequestConfig(params, context, pluginConfig, finalConfig.configPatch));
+	return isCodexAppServerLiveThreadBackgroundOnly(params.client, binding.threadId, fingerprintCodexThreadConfig(resumeParams, authProfileId, context.dynamicToolsFingerprint, binding));
+}
+//#endregion
 //#region extensions/codex/src/app-server/thread-supervision-cleanup.ts
 function withPendingSupervisionCleanup(pending, cleanupThreadIds) {
 	return {
@@ -1917,6 +1945,7 @@ async function startOrResumeThread(input) {
 		const preflight = await prepareCodexThreadLifecyclePreflight(params);
 		const callerConfig = params.config;
 		const { contextEngineBinding, dynamicToolsContainDeferred, dynamicToolsFingerprint, hostSystemAgentActive, legacyDynamicToolsFingerprint, legacyUserMcpServersFingerprint, lifecycleTiming, nativeSkillIsolationFingerprint, networkProxyConfigFingerprint, ringZeroActive, ringZeroClientInstanceId, ringZeroConfigFingerprint, restrictedToolSurface, restrictedToolSurfaceInheritedMcpServerNames, userMcpServersFingerprint, webSearchThreadConfigFingerprint } = preflight;
+		let retainBackgroundPredecessor = false;
 		let replacementPredecessor;
 		const initialBoundThreadId = binding?.threadId;
 		const initialBoundClientId = binding?.clientId;
@@ -2101,21 +2130,6 @@ async function startOrResumeThread(input) {
 			embeddedAgentLog.debug("codex app-server delegation restricted for turn; starting transient thread", { threadId: binding.threadId });
 			binding = void 0;
 		}
-		if (binding?.threadId && (binding.contextEngine || contextEngineBinding)) {
-			if (!contextEngineBinding || !isContextEngineBindingCompatible(binding.contextEngine, contextEngineBinding)) {
-				rotateStaleBinding(binding, "context-engine binding", {
-					engineId: contextEngineBinding?.engineId,
-					previousEngineId: binding.contextEngine?.engineId,
-					epoch: contextEngineBinding?.projection?.epoch,
-					previousEpoch: binding.contextEngine?.projection?.epoch,
-					fingerprint: contextEngineBinding?.projection?.fingerprint,
-					previousFingerprint: binding.contextEngine?.projection?.fingerprint,
-					policyFingerprint: contextEngineBinding?.policyFingerprint,
-					previousPolicyFingerprint: binding.contextEngine?.policyFingerprint
-				});
-				rotatedContextEngineBinding = true;
-			}
-		}
 		if (binding?.threadId) {
 			if (!areUserMcpServersFingerprintsCompatible({
 				previous: binding.userMcpServersFingerprint,
@@ -2132,6 +2146,31 @@ async function startOrResumeThread(input) {
 			})) rotateStaleBinding(binding, "plugin app config");
 			else if (binding.dynamicToolsFingerprint && params.dynamicTools.length > 0 && binding.dynamicToolsContainDeferred !== dynamicToolsContainDeferred && (binding.dynamicToolsContainDeferred !== void 0 || !dynamicToolsContainDeferred)) rotateStaleBinding(binding, "dynamic tool loading");
 		}
+		if (binding?.threadId && (binding.contextEngine || contextEngineBinding)) {
+			if (!contextEngineBinding || !isContextEngineBindingCompatible(binding.contextEngine, contextEngineBinding)) {
+				retainBackgroundPredecessor = initialBoundClientId === clientId && binding.contextEngine?.engineId === contextEngineBinding?.engineId && binding.contextEngine?.policyFingerprint === contextEngineBinding?.policyFingerprint && Boolean(contextEngineBinding) && (!binding.dynamicToolsFingerprint || areCodexDynamicToolFingerprintsCompatible({
+					previous: binding.dynamicToolsFingerprint,
+					next: dynamicToolsFingerprint,
+					nextLegacy: legacyDynamicToolsFingerprint
+				})) && isCodexAppServerLiveThreadBackgroundOnly(params.client, binding.threadId);
+				if (retainBackgroundPredecessor) {
+					const currentPluginConfig = await buildLoadedPluginThreadConfig(binding);
+					if (currentPluginConfig && currentPluginConfig.fingerprint !== binding.pluginAppsFingerprint) retainBackgroundPredecessor = false;
+				}
+				if (retainBackgroundPredecessor) retainBackgroundPredecessor = await canRetainCodexProjectionBackgroundWork(params, binding, await prepareRequestContext(), prebuiltPluginThreadConfig);
+				rotateStaleBinding(binding, "context-engine binding", {
+					engineId: contextEngineBinding?.engineId,
+					previousEngineId: binding.contextEngine?.engineId,
+					epoch: contextEngineBinding?.projection?.epoch,
+					previousEpoch: binding.contextEngine?.projection?.epoch,
+					fingerprint: contextEngineBinding?.projection?.fingerprint,
+					previousFingerprint: binding.contextEngine?.projection?.fingerprint,
+					policyFingerprint: contextEngineBinding?.policyFingerprint,
+					previousPolicyFingerprint: binding.contextEngine?.policyFingerprint
+				});
+				rotatedContextEngineBinding = true;
+			}
+		}
 		if (binding?.threadId) {
 			if (binding.dynamicToolsFingerprint && !areCodexDynamicToolFingerprintsCompatible({
 				previous: binding.dynamicToolsFingerprint,
@@ -2181,7 +2220,7 @@ async function startOrResumeThread(input) {
 		}
 		assertCodexBindingMayBeReplaced(binding, "starting a fresh native thread", expectedOwnership);
 		const requestContext = await prepareRequestContext();
-		if (initialBoundThreadId && !preserveExistingBinding && !configuredMcpOwnershipChanged) await releaseRetainedThread(initialBoundThreadId);
+		if (initialBoundThreadId && !preserveExistingBinding && !configuredMcpOwnershipChanged && !(retainBackgroundPredecessor && isCodexAppServerLiveThreadBackgroundOnly(params.client, initialBoundThreadId))) await releaseRetainedThread(initialBoundThreadId);
 		const started = await startFreshCodexThread(params, {
 			...requestContext,
 			prebuiltPluginThreadConfig,

package/dist/.setup/{thread-ownership-CTUs8Eyu.mjs → thread-ownership-OXzPB_RV.mjs}

@@ -1,7 +1,7 @@
-import { S as retainSharedCodexAppServerClientByInstanceId } from "./auth-cache-key-DvDLHVJe.mjs";
+import { S as retainSharedCodexAppServerClientByInstanceId } from "./auth-cache-key-DrieYJUQ.mjs";
 import { t as withCodexAppServerThreadMutation } from "./thread-ownership-queue-CeyYScUC.mjs";
-import { K as releaseCodexAppServerLiveThread, V as isCodexAppServerLiveThreadClaimed, q as retainCodexAppServerLiveThread } from "./shared-client-wb1JBldZ.mjs";
-import { f as unsubscribeCodexThreadBestEffort, o as closeCodexStartupClientBestEffort, r as CodexAppServerUnsafeSubscriptionError } from "./attempt-client-cleanup-TScCVTsk.mjs";
+import { H as isCodexAppServerLiveThreadClaimed, J as retainCodexAppServerLiveThread, q as releaseCodexAppServerLiveThread } from "./shared-client-AdQX0Tdq.mjs";
+import { f as unsubscribeCodexThreadBestEffort, o as closeCodexStartupClientBestEffort, r as CodexAppServerUnsafeSubscriptionError } from "./attempt-client-cleanup-jWVRH043.mjs";
 import { t as __exportAll } from "./session-binding-sidecars-DijNZb31.mjs";
 import { createDeferred } from "openclaw/plugin-sdk/extension-shared";
 import { runWithAsyncWorkResources } from "openclaw/plugin-sdk/agent-harness-tool-runtime";

package/dist/.setup/{thread-policy-BMRvlOi-.mjs → thread-policy-Dp4CQjdL.mjs}

@@ -1,7 +1,7 @@
 import { i as CodexAppServerScopedRequestRejectedError, o as isCodexAppServerOverloadError } from "./rpc-error-C98SHchT.mjs";
-import { n as requestCodexAppServerClientJson } from "./request-DhbisYCc.mjs";
-import { S as CodexAdoptedThreadActiveError } from "./shared-client-wb1JBldZ.mjs";
-import { p as assertCodexThreadAcceptsDirectInput, s as isCodexAppServerPrewriteRequestCancellationError } from "./client-BpSxNz4F.mjs";
+import { n as requestCodexAppServerClientJson } from "./request-XC1RG34l.mjs";
+import { S as CodexAdoptedThreadActiveError } from "./shared-client-AdQX0Tdq.mjs";
+import { p as assertCodexThreadAcceptsDirectInput, s as isCodexAppServerPrewriteRequestCancellationError } from "./client-BM97zH3z.mjs";
 import { AgentHarnessPreflightError, embeddedAgentLog, formatErrorMessage } from "openclaw/plugin-sdk/agent-harness-runtime";
 //#region extensions/codex/src/app-server/thread-policy.ts
 /** A refusal, not a failed native write: the ephemeral conversation must stay alive. */

package/dist/.setup/{thread-requests-BqPhA4Gs.mjs → thread-requests-DjyDmCo4.mjs}

@@ -1,7 +1,7 @@
 import { i as isJsonObject } from "./protocol-CANUwXJ3.mjs";
-import { d as readCodexEffectiveConfig, u as CODEX_SESSION_OVERRIDABLE_LAYER_TYPES } from "./config-options-nvYwVDyy.mjs";
+import { d as readCodexEffectiveConfig, u as CODEX_SESSION_OVERRIDABLE_LAYER_TYPES } from "./config-options-CZmH25Xq.mjs";
 import { a as isCodexResponsesOAuthRun } from "./responses-oauth-twnuTaAa.mjs";
-import { d as mergeCodexThreadConfigs, t as buildCodexProjectDocThreadConfig } from "./project-doc-thread-config-B2ZD23A_.mjs";
+import { d as mergeCodexThreadConfigs, t as buildCodexProjectDocThreadConfig } from "./project-doc-thread-config-D_sWbxFR.mjs";
 import { o as hashCodexAppServerBindingFingerprint } from "./session-binding-BDnNz-Co.mjs";
 import { n as resolveCodexAppServerModelProvider, r as resolveCodexAppServerRequestModelSelection, t as CODEX_NATIVE_PERSONALITY_NONE } from "./thread-model-selection-DcVebr8N.mjs";
 import { normalizeOptionalString, normalizeUniqueStringEntries, normalizeUniqueTrimmedStringList } from "openclaw/plugin-sdk/string-coerce-runtime";

package/dist/.setup/{thread-resume-CD48Vab8.mjs → thread-resume-8YKfRoX6.mjs}

@@ -1,8 +1,8 @@
 import { i as CodexAppServerScopedRequestRejectedError, o as isCodexAppServerOverloadError, r as CodexAppServerRpcError } from "./rpc-error-C98SHchT.mjs";
-import { r as publishCodexCatalogResume } from "./session-catalog-events-IoszcO7-.mjs";
-import { L as forgetCodexWorkspaceReferences, pt as isCodexAppServerStartupError, u as isCodexAppServerStartSelectionChangedError } from "./shared-client-wb1JBldZ.mjs";
-import { h as assertCodexThreadResumeResponse, s as isCodexAppServerPrewriteRequestCancellationError } from "./client-BpSxNz4F.mjs";
-import { f as unsubscribeCodexThreadBestEffort, i as assertCodexThreadResumeSubscription, r as CodexAppServerUnsafeSubscriptionError } from "./attempt-client-cleanup-TScCVTsk.mjs";
+import { r as publishCodexCatalogResume } from "./session-catalog-events-CpEyDv0D.mjs";
+import { L as forgetCodexWorkspaceReferences, gt as isCodexAppServerStartupError, u as isCodexAppServerStartSelectionChangedError } from "./shared-client-AdQX0Tdq.mjs";
+import { h as assertCodexThreadResumeResponse, s as isCodexAppServerPrewriteRequestCancellationError } from "./client-BM97zH3z.mjs";
+import { f as unsubscribeCodexThreadBestEffort, i as assertCodexThreadResumeSubscription, r as CodexAppServerUnsafeSubscriptionError } from "./attempt-client-cleanup-jWVRH043.mjs";
 import { sanitizeTerminalText } from "openclaw/plugin-sdk/text-chunking";
 //#region extensions/codex/src/app-server/thread-resume.ts
 /** Owns Codex thread/resume subscription safety. */

package/dist/.setup/{transport-websocket-DOY0dJXN.mjs → transport-websocket-CEBjEtFP.mjs}

@@ -1,5 +1,5 @@
 import { r as resolveCodexAppServerUserHomeDir } from "./auth-start-options-BPIPeEX8.mjs";
-import "./config-G4IGX6bK.mjs";
+import "./config-LQemoqTL.mjs";
 import { t as codexWebSocketDataToBuffer } from "./websocket-data-XlRvt8Ys.mjs";
 import path from "node:path";
 import { EventEmitter } from "node:events";

package/dist/.setup/{turn-router-DdlzuFdm.mjs → turn-router-DnfbVPvu.mjs}

@@ -1,6 +1,6 @@
 import { i as isJsonObject } from "./protocol-CANUwXJ3.mjs";
 import { n as waitForPromiseOrAbort, t as abortReason } from "./timeout-D0mEWSGG.mjs";
-import { x as readCodexTurnCompletedNotification } from "./client-BpSxNz4F.mjs";
+import { x as readCodexTurnCompletedNotification } from "./client-BM97zH3z.mjs";
 import { normalizeOptionalString, readStringField } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { AsyncResource } from "node:async_hooks";
 import { createDeferred } from "openclaw/plugin-sdk/extension-shared";