@openclaw/codex 2026.10.7 → 2026.10.8

package/dist/.setup/{session-binding-sidecars-DijNZb31.mjs → session-binding-sidecars-CAHe3enw.mjs}

@@ -482,7 +482,7 @@ async function migrateSource(source, candidates, params, store) {
 		return await withFileLock(source.sidecarPath, LEGACY_BINDING_LOCK_OPTIONS, async () => {
 			const [contents, stat] = await Promise.all([fs.readFile(source.sidecarPath, "utf8"), fs.stat(source.sidecarPath)]);
 			const raw = JSON.parse(contents);
-			const [{ bindingStoreKey, createStoredCodexAppServerBinding, normalizeStoredCodexAppServerBindingFingerprints, readStoredCodexAppServerBinding }, { legacyCodexConversationBindingId }] = await Promise.all([import("./session-binding-BDnNz-Co.mjs").then((n) => n.a), import("./conversation-binding-data-GRGSgAro.mjs").then((n) => n.t)]);
+			const [{ bindingStoreKey, createStoredCodexAppServerBinding, normalizeStoredCodexAppServerBindingFingerprints, readStoredCodexAppServerBinding }, { legacyCodexConversationBindingId }] = await Promise.all([import("./session-binding-_RE7vtVN.mjs").then((n) => n.a), import("./conversation-binding-data-BqzGWkPW.mjs").then((n) => n.t)]);
 			const agentId = owner?.agentId ?? (source.agentIds.size === 1 ? [...source.agentIds][0] : void 0);
 			const baseStored = createStoredCodexAppServerBinding(raw, {
 				now: stat.mtime.toISOString(),

package/dist/.setup/{session-catalog-adoption-Cl6fHxS5.mjs → session-catalog-adoption-DuChFASf.mjs}

@@ -1,8 +1,8 @@
-import { T as requireBoundThread, d as boundedCatalogString, o as CatalogParamsError } from "./session-catalog-parsing-B4OyhylL.mjs";
-import { m as sessionBindingIdentity } from "./session-binding-record-C2kDBZhx.mjs";
+import { T as requireBoundThread, d as boundedCatalogString, o as CatalogParamsError } from "./session-catalog-parsing-DmZmgRou.mjs";
+import { m as sessionBindingIdentity } from "./session-binding-record-O62ZRFhy.mjs";
 import { n as codexUpstreamBaseline, t as codexLastTerminalTurnId } from "./session-upstream-marker-D15C9NHp.mjs";
-import { r as reclaimCurrentCodexSessionGeneration } from "./session-binding-BDnNz-Co.mjs";
-import { adoptionSessionKeyRest, catalogSessionActions } from "./session-catalog-node-adoption-D11N0CMr.mjs";
+import { r as reclaimCurrentCodexSessionGeneration } from "./session-binding-_RE7vtVN.mjs";
+import { adoptionSessionKeyRest, catalogSessionActions } from "./session-catalog-node-adoption-BjYvYtAd.mjs";
 import { isRecord } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { listSessionCatalogEntries, sessionCatalogAdoptedSessionKey, sessionCatalogAdoptedSourceKey } from "openclaw/plugin-sdk/session-catalog";
 //#region extensions/codex/src/session-catalog-adoption.ts
@@ -164,7 +164,7 @@ async function createOrReuseAdoptedSession(params) {
 			sourceThreadId: params.sourceThread.id,
 			...params.sourceHomeId ? { sourceHomeId: params.sourceHomeId } : {}
 		};
-		const { createImportedCodexSession } = await import("./session-history-import-DgwRu2eD.mjs");
+		const { createImportedCodexSession } = await import("./session-history-import-BhOzqhyI.mjs");
 		const created = await createImportedCodexSession({
 			runtime: params.api.runtime,
 			bindingStore: params.bindingStore,

package/dist/.setup/{session-catalog-archive-CUU7jEkO.mjs → session-catalog-archive-Bs5cP3zm.mjs}

@@ -1,9 +1,9 @@
-import { o as CatalogParamsError } from "./session-catalog-parsing-B4OyhylL.mjs";
-import { m as sessionBindingIdentity } from "./session-binding-record-C2kDBZhx.mjs";
+import { o as CatalogParamsError } from "./session-catalog-parsing-DmZmgRou.mjs";
+import { m as sessionBindingIdentity } from "./session-binding-record-O62ZRFhy.mjs";
 import { t as assertCodexArchiveDescendantsUnowned } from "./thread-archive-guard-LKdwQKyr.mjs";
-import "./session-binding-BDnNz-Co.mjs";
-import { catalogSessionActions } from "./session-catalog-node-adoption-D11N0CMr.mjs";
-import { isAdoptionSessionKeyForThread, requireIdleThread } from "./session-catalog-adoption-Cl6fHxS5.mjs";
+import "./session-binding-_RE7vtVN.mjs";
+import { catalogSessionActions } from "./session-catalog-node-adoption-BjYvYtAd.mjs";
+import { isAdoptionSessionKeyForThread, requireIdleThread } from "./session-catalog-adoption-DuChFASf.mjs";
 import { listAgentIds } from "openclaw/plugin-sdk/agent-scope-runtime";
 import { sessionCatalogAdoptedSourceKey } from "openclaw/plugin-sdk/session-catalog";
 //#region extensions/codex/src/session-catalog-archive.ts

package/dist/.setup/{session-catalog-events-CpEyDv0D.mjs → session-catalog-events-C8i0HBz5.mjs}

@@ -1,11 +1,11 @@
-import { c as MAX_CWD_LENGTH, d as boundedCatalogString } from "./session-catalog-parsing-B4OyhylL.mjs";
-import { n as defineCodexBuildState } from "./build-state-B5mKL-in.mjs";
+import { c as MAX_CWD_LENGTH, d as boundedCatalogString } from "./session-catalog-parsing-DmZmgRou.mjs";
+import { n as defineCodexBuildState } from "./build-state-vxQdf_74.mjs";
 import { r as inferCodexAppServerConnectionClass } from "./config-security-DpkGNy5T.mjs";
 import { n as resolveCodexAppServerLocalHomeDir } from "./auth-start-options-BPIPeEX8.mjs";
 import { n as codexCatalogHomeIdFromCanonicalPath } from "./session-catalog-home-id-vlih0B_g.mjs";
 import { t as buildCodexAppServerConnectionFingerprint } from "./plugin-app-cache-key-Bg9DbDI6.mjs";
-import { n as codexCatalogSourceForClient, o as observeCodexCatalogEphemeralThreads } from "./session-catalog-source-CfIBVrbT.mjs";
-import { r as projectCodexCatalogNativeThread } from "./session-catalog-native-projection-BYV0ICja.mjs";
+import { n as codexCatalogSourceForClient, o as observeCodexCatalogEphemeralThreads } from "./session-catalog-source-0x1LVwV-.mjs";
+import { r as projectCodexCatalogNativeThread } from "./session-catalog-native-projection-C6KOqnIb.mjs";
 import { createHash } from "node:crypto";
 import { embeddedAgentLog } from "openclaw/plugin-sdk/agent-harness-registration";
 import path from "node:path";

package/dist/.setup/{session-catalog-index-order-B30rjUEJ.mjs → session-catalog-index-order-CTSrDiE1.mjs}

@@ -1,4 +1,4 @@
-import { t as CODEX_CATALOG_MAX_ROWS } from "./session-catalog-limits-Daqt3JLk.mjs";
+import { t as CODEX_CATALOG_MAX_ROWS } from "./session-catalog-limits-9Ay62KQ0.mjs";
 //#region extensions/codex/src/session-catalog-index-order.ts
 function codexCatalogRowRecency(row) {
 	return row.recencyAt ?? row.updatedAt ?? 0;

package/dist/.setup/{session-catalog-index-DpYCf1-8.mjs → session-catalog-index-zqaZhwr2.mjs}

@@ -1,12 +1,12 @@
-import { S as readControlCursor, _ as normalizeLimit, c as MAX_CWD_LENGTH, d as boundedCatalogString, h as filterCatalogPageByTitle, m as codexCatalogThreadStatus, o as CatalogParamsError, p as codexCatalogThreadName } from "./session-catalog-parsing-B4OyhylL.mjs";
-import { n as detachCodexCatalogString, t as CODEX_CATALOG_MAX_ROWS } from "./session-catalog-limits-Daqt3JLk.mjs";
-import { i as retainCodexCatalogRow, n as codexCatalogRowRecency, r as compareCodexCatalogRows, t as CodexCatalogOrdering } from "./session-catalog-index-order-B30rjUEJ.mjs";
-import { c as CodexCatalogPersistence, i as CodexCatalogAvailability, l as codexCatalogMetadataPage, r as withCodexCatalogListRequest } from "./session-catalog-list-request-SJyGz02j.mjs";
-import { a as hasLiveCodexCatalogSource, c as setCodexCatalogSource, i as getCodexCatalogSource } from "./session-catalog-source-CfIBVrbT.mjs";
-import { r as projectCodexCatalogNativeThread } from "./session-catalog-native-projection-BYV0ICja.mjs";
-import { i as subscribeCodexCatalogEvents } from "./session-catalog-events-CpEyDv0D.mjs";
+import { S as readControlCursor, _ as normalizeLimit, c as MAX_CWD_LENGTH, d as boundedCatalogString, h as filterCatalogPageByTitle, m as codexCatalogThreadStatus, o as CatalogParamsError, p as codexCatalogThreadName } from "./session-catalog-parsing-DmZmgRou.mjs";
+import { n as detachCodexCatalogString, t as CODEX_CATALOG_MAX_ROWS } from "./session-catalog-limits-9Ay62KQ0.mjs";
+import { i as retainCodexCatalogRow, n as codexCatalogRowRecency, r as compareCodexCatalogRows, t as CodexCatalogOrdering } from "./session-catalog-index-order-CTSrDiE1.mjs";
+import { c as CodexCatalogPersistence, i as CodexCatalogAvailability, l as codexCatalogMetadataPage, r as withCodexCatalogListRequest } from "./session-catalog-list-request-uKKvUIoN.mjs";
+import { a as hasLiveCodexCatalogSource, c as setCodexCatalogSource, i as getCodexCatalogSource } from "./session-catalog-source-0x1LVwV-.mjs";
+import { r as projectCodexCatalogNativeThread } from "./session-catalog-native-projection-C6KOqnIb.mjs";
+import { i as subscribeCodexCatalogEvents } from "./session-catalog-events-C8i0HBz5.mjs";
 import { a as reportCodexCatalogSpawnFailure, n as findCodexAppServerSpawnError } from "./spawn-error-CL3n6MAa.mjs";
-import { CodexCatalogProjectionCapacityError, CodexCatalogProjections, mergeCodexCatalogRolloutRow, n as readCodexCatalogRollout, projectCodexCatalogPage, r as resolveCodexCatalogRolloutFingerprint, t as codexCatalogRolloutLogicalPath } from "./session-catalog-projection-B0IyXrHt.mjs";
+import { CodexCatalogProjectionCapacityError, CodexCatalogProjections, mergeCodexCatalogRolloutRow, n as readCodexCatalogRollout, projectCodexCatalogPage, r as resolveCodexCatalogRolloutFingerprint, t as codexCatalogRolloutLogicalPath } from "./session-catalog-projection-DD5m0grG.mjs";
 import { isRecord } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { createHash } from "node:crypto";
 import { isDeepStrictEqual } from "node:util";

package/dist/.setup/{session-catalog-limits-Daqt3JLk.mjs → session-catalog-limits-9Ay62KQ0.mjs}

@@ -1,4 +1,4 @@
-import { t as __exportAll } from "./session-binding-sidecars-DijNZb31.mjs";
+import { t as __exportAll } from "./session-binding-sidecars-CAHe3enw.mjs";
 //#region extensions/codex/src/session-catalog-limits.ts
 var session_catalog_limits_exports = /* @__PURE__ */ __exportAll({
 	CODEX_CATALOG_MAX_ROWS: () => CODEX_CATALOG_MAX_ROWS,

package/dist/.setup/{session-catalog-list-request-SJyGz02j.mjs → session-catalog-list-request-uKKvUIoN.mjs}

@@ -1,6 +1,6 @@
-import { o as CatalogParamsError, v as parseCatalogPage } from "./session-catalog-parsing-B4OyhylL.mjs";
-import { n as detachCodexCatalogString } from "./session-catalog-limits-Daqt3JLk.mjs";
-import { i as retainCodexCatalogRow, r as compareCodexCatalogRows } from "./session-catalog-index-order-B30rjUEJ.mjs";
+import { o as CatalogParamsError, v as parseCatalogPage } from "./session-catalog-parsing-DmZmgRou.mjs";
+import { n as detachCodexCatalogString } from "./session-catalog-limits-9Ay62KQ0.mjs";
+import { i as retainCodexCatalogRow, r as compareCodexCatalogRows } from "./session-catalog-index-order-CTSrDiE1.mjs";
 import { i as withTimeout } from "./timeout-D0mEWSGG.mjs";
 import { isRecord } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { createHash } from "node:crypto";

package/dist/.setup/{session-catalog-native-projection-BYV0ICja.mjs → session-catalog-native-projection-C6KOqnIb.mjs}

@@ -1,8 +1,8 @@
-import { D as selectCodexCatalogPreviewInput, c as MAX_CWD_LENGTH, d as boundedCatalogString, k as truncateCodexCatalogPreview } from "./session-catalog-parsing-B4OyhylL.mjs";
+import { D as selectCodexCatalogPreviewInput, c as MAX_CWD_LENGTH, d as boundedCatalogString, k as truncateCodexCatalogPreview } from "./session-catalog-parsing-DmZmgRou.mjs";
 import { i as isJsonObject } from "./protocol-CANUwXJ3.mjs";
-import { n as detachCodexCatalogString } from "./session-catalog-limits-Daqt3JLk.mjs";
-import { r as copyCodexCatalogSource } from "./session-catalog-source-CfIBVrbT.mjs";
-import { t as __exportAll } from "./session-binding-sidecars-DijNZb31.mjs";
+import { n as detachCodexCatalogString } from "./session-catalog-limits-9Ay62KQ0.mjs";
+import { r as copyCodexCatalogSource } from "./session-catalog-source-0x1LVwV-.mjs";
+import { t as __exportAll } from "./session-binding-sidecars-CAHe3enw.mjs";
 import { truncateUtf16Safe } from "openclaw/plugin-sdk/text-utility-runtime";
 //#region extensions/codex/src/session-catalog-native-projection.ts
 var session_catalog_native_projection_exports = /* @__PURE__ */ __exportAll({

package/dist/.setup/{session-catalog-node-adoption-D11N0CMr.mjs → session-catalog-node-adoption-BjYvYtAd.mjs}

@@ -1,4 +1,4 @@
-import { o as CatalogParamsError } from "./session-catalog-parsing-B4OyhylL.mjs";
+import { o as CatalogParamsError } from "./session-catalog-parsing-DmZmgRou.mjs";
 import { isRecord } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { KeyedAsyncQueue } from "openclaw/plugin-sdk/keyed-async-queue";
 import { parseAgentSessionKey } from "openclaw/plugin-sdk/routing";
@@ -156,7 +156,7 @@ async function createOrReuseNodeAdoptedSession(params) {
 			},
 			afterCreate: async (entry) => {
 				const storePath = resolveStorePath(params.config.session?.store, { agentId: entry.agentId });
-				const { importCodexThreadHistoryToTranscript } = await import("./transcript-mirror-DVEzdOs0.mjs").then((n) => n.a);
+				const { importCodexThreadHistoryToTranscript } = await import("./transcript-mirror-CPdcVWTn.mjs").then((n) => n.a);
 				await importCodexThreadHistoryToTranscript({
 					thread: params.history.thread,
 					throughTurnId: params.history.throughTurnId,

package/dist/.setup/{session-catalog-node-continue-Ct62GeL1.mjs → session-catalog-node-continue-BEI9D3ev.mjs}

@@ -1,10 +1,10 @@
-import { A as unwrapNodeInvokePayload, b as parseTranscriptPage, d as boundedCatalogString, f as catalogError, g as isInteractiveThreadSource, h as filterCatalogPageByTitle, n as CODEX_APP_SERVER_THREADS_LIST_COMMAND, o as CatalogParamsError, r as CODEX_APP_SERVER_THREAD_TURNS_LIST_COMMAND, u as NODE_INVOKE_TIMEOUT_MS, v as parseCatalogPage } from "./session-catalog-parsing-B4OyhylL.mjs";
-import { n as createCodexCliNodeConversationBindingData } from "./conversation-binding-data-GRGSgAro.mjs";
-import { r as CODEX_CLI_SESSION_SOURCE_UPGRADE_MESSAGE, t as CODEX_CLI_SESSION_RESUME_COMMAND } from "./node-cli-sessions-BxVYZNuY.mjs";
+import { A as unwrapNodeInvokePayload, b as parseTranscriptPage, d as boundedCatalogString, f as catalogError, g as isInteractiveThreadSource, h as filterCatalogPageByTitle, n as CODEX_APP_SERVER_THREADS_LIST_COMMAND, o as CatalogParamsError, r as CODEX_APP_SERVER_THREAD_TURNS_LIST_COMMAND, u as NODE_INVOKE_TIMEOUT_MS, v as parseCatalogPage } from "./session-catalog-parsing-DmZmgRou.mjs";
+import { n as createCodexCliNodeConversationBindingData } from "./conversation-binding-data-BqzGWkPW.mjs";
+import { r as CODEX_CLI_SESSION_SOURCE_UPGRADE_MESSAGE, t as CODEX_CLI_SESSION_RESUME_COMMAND } from "./node-cli-sessions-BQNAFnCa.mjs";
 import { i as withTimeout } from "./timeout-D0mEWSGG.mjs";
-import { t as lookupNodeCodexCatalogRecord } from "./session-catalog-node-lookup-DQVe6vhs.mjs";
+import { t as lookupNodeCodexCatalogRecord } from "./session-catalog-node-lookup-CBomNvUN.mjs";
 import { t as codexLastTerminalTurnId } from "./session-upstream-marker-D15C9NHp.mjs";
-import { catalogSessionActions, createOrReuseNodeAdoptedSession, finalizeNodeAdoptedSession, findNodeAdoptedSessionEntry, nodeAdoptedSourceKey, nodeSessionMarker } from "./session-catalog-node-adoption-D11N0CMr.mjs";
+import { catalogSessionActions, createOrReuseNodeAdoptedSession, finalizeNodeAdoptedSession, findNodeAdoptedSessionEntry, nodeAdoptedSourceKey, nodeSessionMarker } from "./session-catalog-node-adoption-BjYvYtAd.mjs";
 import { resolveSessionAgentIdsStrict } from "openclaw/plugin-sdk/agent-scope-runtime";
 import { createSessionCatalogAdoptionCoordinator, publishSessionCatalogHost, sessionCatalogAdoptedSourceKey } from "openclaw/plugin-sdk/session-catalog";
 //#region extensions/codex/src/session-catalog-node-continue.ts

package/dist/.setup/{session-catalog-node-lookup-DQVe6vhs.mjs → session-catalog-node-lookup-CBomNvUN.mjs}

@@ -1,5 +1,5 @@
-import { A as unwrapNodeInvokePayload, n as CODEX_APP_SERVER_THREADS_LIST_COMMAND, o as CatalogParamsError, u as NODE_INVOKE_TIMEOUT_MS, v as parseCatalogPage } from "./session-catalog-parsing-B4OyhylL.mjs";
-import "./session-catalog-limits-Daqt3JLk.mjs";
+import { A as unwrapNodeInvokePayload, n as CODEX_APP_SERVER_THREADS_LIST_COMMAND, o as CatalogParamsError, u as NODE_INVOKE_TIMEOUT_MS, v as parseCatalogPage } from "./session-catalog-parsing-DmZmgRou.mjs";
+import "./session-catalog-limits-9Ay62KQ0.mjs";
 import { i as withTimeout } from "./timeout-D0mEWSGG.mjs";
 //#region extensions/codex/src/session-catalog-node-lookup.ts
 async function lookupNodeCodexCatalogRecord(params) {

package/dist/.setup/{session-catalog-parsing-B4OyhylL.mjs → session-catalog-parsing-DmZmgRou.mjs}

@@ -1,5 +1,5 @@
 import "./protocol-CANUwXJ3.mjs";
-import { n as detachCodexCatalogString } from "./session-catalog-limits-Daqt3JLk.mjs";
+import { n as detachCodexCatalogString } from "./session-catalog-limits-9Ay62KQ0.mjs";
 import { asFiniteNumber, isRecord } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { truncateUtf16Safe } from "openclaw/plugin-sdk/text-utility-runtime";
 //#region extensions/codex/src/app-server/protocol-session-source.ts

package/dist/.setup/{session-catalog-projection-B0IyXrHt.mjs → session-catalog-projection-DD5m0grG.mjs}

@@ -1,8 +1,8 @@
-import { D as selectCodexCatalogPreviewInput, O as toCatalogSession, S as readControlCursor, d as boundedCatalogString, k as truncateCodexCatalogPreview } from "./session-catalog-parsing-B4OyhylL.mjs";
-import { n as detachCodexCatalogString } from "./session-catalog-limits-Daqt3JLk.mjs";
-import { n as codexCatalogRowRecency } from "./session-catalog-index-order-B30rjUEJ.mjs";
+import { D as selectCodexCatalogPreviewInput, O as toCatalogSession, S as readControlCursor, d as boundedCatalogString, k as truncateCodexCatalogPreview } from "./session-catalog-parsing-DmZmgRou.mjs";
+import { n as detachCodexCatalogString } from "./session-catalog-limits-9Ay62KQ0.mjs";
+import { n as codexCatalogRowRecency } from "./session-catalog-index-order-CTSrDiE1.mjs";
 import { t as isOpenClawManagedCodexThread } from "./session-catalog-provenance-CmsOE5mh.mjs";
-import { c as setCodexCatalogSource, i as getCodexCatalogSource, r as copyCodexCatalogSource } from "./session-catalog-source-CfIBVrbT.mjs";
+import { c as setCodexCatalogSource, i as getCodexCatalogSource, r as copyCodexCatalogSource } from "./session-catalog-source-0x1LVwV-.mjs";
 import { asFiniteNumber, isRecord } from "openclaw/plugin-sdk/string-coerce-runtime";
 import path from "node:path";
 import fs from "node:fs/promises";

package/dist/.setup/{session-catalog-source-CfIBVrbT.mjs → session-catalog-source-0x1LVwV-.mjs}

@@ -1,4 +1,4 @@
-import { n as defineCodexBuildState } from "./build-state-B5mKL-in.mjs";
+import { n as defineCodexBuildState } from "./build-state-vxQdf_74.mjs";
 //#region extensions/codex/src/session-catalog-source.ts
 function hasLiveCodexCatalogSource(sources) {
 	for (const source of sources) if (!source.closed) return true;

package/dist/.setup/{session-cli-BoJSZfGd.mjs → session-cli-B1f7NqXo.mjs}

@@ -1,4 +1,4 @@
-import "./session-catalog-parsing-B4OyhylL.mjs";
+import "./session-catalog-parsing-DmZmgRou.mjs";
 import { isRecord } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { truncateUtf16Safe } from "openclaw/plugin-sdk/text-utility-runtime";
 import { normalizeAgentId } from "openclaw/plugin-sdk/routing";

package/dist/.setup/{session-history-import-DgwRu2eD.mjs → session-history-import-BhOzqhyI.mjs}

@@ -1,7 +1,7 @@
-import { m as sessionBindingIdentity } from "./session-binding-record-C2kDBZhx.mjs";
-import "./session-binding-BDnNz-Co.mjs";
-import { r as importCodexThreadHistoryToTranscript } from "./transcript-mirror-DVEzdOs0.mjs";
-import { n as prepareCodexSessionInitialization } from "./session-initialization-BjVtsTzi.mjs";
+import { m as sessionBindingIdentity } from "./session-binding-record-O62ZRFhy.mjs";
+import "./session-binding-_RE7vtVN.mjs";
+import { r as importCodexThreadHistoryToTranscript } from "./transcript-mirror-CPdcVWTn.mjs";
+import { n as prepareCodexSessionInitialization } from "./session-initialization-Bwe0Bikj.mjs";
 import { resolveStorePath } from "openclaw/plugin-sdk/session-store-runtime";
 //#region extensions/codex/src/app-server/session-history-import.ts
 /** Creates a session whose transcript is derived from one verified Codex thread snapshot. */

package/dist/.setup/{session-history.worker-DJQfek5p.mjs → session-history.worker-D2v5yRcB.mjs}

@@ -305,12 +305,14 @@ function projectVerifiedSettledCodexMessages(history, params) {
 }
 /** Yields only the settled prefix, but exhausts suffix identity checks before accepting it. */
 function* verifiedSettledMessages(history, params, prior) {
-	const promptIdentity = `${params.turnId}:prompt`;
+	const promptIdentity = params.promptIdentity ?? `${params.turnId}:prompt`;
 	const boundaryIndex = params.settledMessages.findLastIndex((message) => message.role === "toolResult");
 	const boundary = params.settledMessages[boundaryIndex];
 	const boundaryIdentity = boundary && readMirrorIdentity(boundary);
 	const requiredIds = params.settledMessages.slice(0, boundaryIndex + 1).flatMap((message) => readMirrorIdentity(message) ?? []);
-	if (!boundaryIdentity?.startsWith(`${params.turnId}:tool:`) || requiredIds.length !== boundaryIndex + 1 || new Set(requiredIds).size !== requiredIds.length || !requiredIds.includes(promptIdentity)) rejectEvidence();
+	const anchorIdentity = params.promptSuppressed ? requiredIds[0] : promptIdentity;
+	const hasPrompt = requiredIds.includes(promptIdentity);
+	if (!boundaryIdentity?.startsWith(`${params.turnId}:tool:`) || requiredIds.length !== boundaryIndex + 1 || new Set(requiredIds).size !== requiredIds.length || (params.promptSuppressed ? hasPrompt || !anchorIdentity?.startsWith(`${params.turnId}:`) : !hasPrompt)) rejectEvidence();
 	const mirrored = params.mirroredMessages;
 	const mirroredIds = mirrored.flatMap((message) => readMirrorIdentity(message) ?? []);
 	const mirroredBoundaryIndex = mirrored.findIndex((message) => readMirrorIdentity(message) === boundaryIdentity);
@@ -331,7 +333,7 @@ function* verifiedSettledMessages(history, params, prior) {
 				matched += 1;
 			}
 		}
-		currentStarted ||= identity === promptIdentity;
+		currentStarted ||= identity === anchorIdentity;
 		if (!currentStarted) prior.append(message);
 		else if (!throughBoundary) yield message;
 		throughBoundary ||= identity === boundaryIdentity;

package/dist/.setup/{session-initialization-BjVtsTzi.mjs → session-initialization-Bwe0Bikj.mjs}

@@ -1,5 +1,5 @@
 import { s as validateBindingForWrite } from "./session-binding-record-codec-CWQXr9os.mjs";
-import "./session-binding-BDnNz-Co.mjs";
+import "./session-binding-_RE7vtVN.mjs";
 import { createNativeSessionInitializationOwner } from "openclaw/plugin-sdk/agent-harness-session-runtime";
 //#region extensions/codex/src/app-server/session-initialization.ts
 const { prepare: prepareCodexSessionInitialization, getRollback: getCodexSessionInitializationRollback } = createNativeSessionInitializationOwner({

package/dist/.setup/{session-retirement-CKIS7jFv.mjs → session-retirement-BIFmgIgn.mjs}

@@ -1,10 +1,10 @@
-import { S as retainSharedCodexAppServerClientByInstanceId } from "./auth-cache-key-DrieYJUQ.mjs";
+import { S as retainSharedCodexAppServerClientByInstanceId } from "./auth-cache-key-8VTsPn2f.mjs";
 import { t as withCodexAppServerThreadMutation } from "./thread-ownership-queue-CeyYScUC.mjs";
-import { H as isCodexAppServerLiveThreadClaimed, R as hasCodexAppServerLiveThread, q as releaseCodexAppServerLiveThread } from "./shared-client-AdQX0Tdq.mjs";
-import { f as unsubscribeCodexThreadBestEffort, n as CODEX_APP_SERVER_UNSUBSCRIBE_TIMEOUT_MS, o as closeCodexStartupClientBestEffort, r as CodexAppServerUnsafeSubscriptionError } from "./attempt-client-cleanup-jWVRH043.mjs";
-import { t as isSameCodexAppServerThreadOwner } from "./thread-ownership-OXzPB_RV.mjs";
-import { t as codexNativeSubagentMonitorRuntime } from "./native-subagent-monitor-CJaIve3h.mjs";
-import { t as getCodexSessionInitializationRollback } from "./session-initialization-BjVtsTzi.mjs";
+import { H as isCodexAppServerLiveThreadClaimed, R as hasCodexAppServerLiveThread, q as releaseCodexAppServerLiveThread } from "./shared-client-Bo9MCCKj.mjs";
+import { f as unsubscribeCodexThreadBestEffort, n as CODEX_APP_SERVER_UNSUBSCRIBE_TIMEOUT_MS, o as closeCodexStartupClientBestEffort, r as CodexAppServerUnsafeSubscriptionError } from "./attempt-client-cleanup-BmPBqnW3.mjs";
+import { t as isSameCodexAppServerThreadOwner } from "./thread-ownership-C5Hpc-Q1.mjs";
+import { t as codexNativeSubagentMonitorRuntime } from "./native-subagent-monitor-CuNglHrq.mjs";
+import { t as getCodexSessionInitializationRollback } from "./session-initialization-Bwe0Bikj.mjs";
 import { isIncognitoSessionKey } from "openclaw/plugin-sdk/session-key-runtime";
 import { isNativeSessionDeletionUnresolved, wrapNativeSessionDeletionMutation } from "openclaw/plugin-sdk/agent-harness-session-runtime";
 //#region extensions/codex/src/app-server/session-retirement.ts

package/dist/.setup/{settled-turn-finalizer-CnIWbqN7.mjs → settled-turn-finalizer-9WZ-Hnwo.mjs}

@@ -1,12 +1,12 @@
 import { i as readMirrorIdentity, n as attachCodexMirrorIdentity } from "./upstream-prompt-provenance-Ccd9MFRJ.mjs";
 import { l as readCodexMirrorSourceFingerprint, o as fingerprintCodexMirrorSourceMessage } from "./transcript-mirror-attestation-BzUXnrvv.mjs";
-import { at as resolveCodexAppServerPreparedAuthHandoff } from "./shared-client-AdQX0Tdq.mjs";
-import { f as assertCodexPassiveTurnItems } from "./client-BM97zH3z.mjs";
-import { runBoundedCodexAppServerTurn } from "./bounded-turn-s9yVsxaM.mjs";
+import { at as resolveCodexAppServerPreparedAuthHandoff } from "./shared-client-Bo9MCCKj.mjs";
+import { f as assertCodexPassiveTurnItems } from "./client-BTWv2cJe.mjs";
+import { runBoundedCodexAppServerTurn } from "./bounded-turn-DByEneJg.mjs";
 import { t as resolveCodexLocalRuntimeAttribution } from "./local-runtime-attribution-CZz2DJ4q.mjs";
-import { t as resolveCodexBoundedTurnIsolation } from "./bounded-turn-isolation-CIQJykuM.mjs";
+import { t as resolveCodexBoundedTurnIsolation } from "./bounded-turn-isolation-BRNgfoRl.mjs";
 import { a as createAttributedCodexAssistantMessage } from "./event-projector-assistant-message-CLMKN4x-.mjs";
-import { t as codexTranscriptMirrorRuntime } from "./transcript-mirror-DVEzdOs0.mjs";
+import { t as codexTranscriptMirrorRuntime } from "./transcript-mirror-CPdcVWTn.mjs";
 import { t as CodexSettledTurnContext } from "./settled-turn-context-BPL6D3RO.mjs";
 import { createNativeSessionBindingAuthority } from "openclaw/plugin-sdk/agent-harness-session-runtime";
 import { isSilentReplyText } from "openclaw/plugin-sdk/reply-runtime";

package/dist/.setup/{shared-client-AdQX0Tdq.mjs → shared-client-Bo9MCCKj.mjs}

@@ -1,23 +1,23 @@
 import { i as isJsonObject } from "./protocol-CANUwXJ3.mjs";
-import { n as defineCodexBuildState, t as codexBuildSymbol } from "./build-state-B5mKL-in.mjs";
+import { n as defineCodexBuildState, t as codexBuildSymbol } from "./build-state-vxQdf_74.mjs";
 import { t as CODEX_APP_SERVER_AUTH_PROVIDER } from "./auth-profile-selection-hr8ocLtz.mjs";
 import { n as isCodexAppServerProxyLaunch } from "./launch-args-DbFCehO7.mjs";
 import { a as withEphemeralCodexAuthStore, i as withClearedEnvironmentVariables, n as resolveCodexAppServerLocalHomeDir, r as resolveCodexAppServerUserHomeDir, t as resolveCodexAppServerHomeDir } from "./auth-start-options-BPIPeEX8.mjs";
 import { a as resolveCodexAppServerStartOptionsForAgent, d as readCodexEffectiveConfig, o as resolveCodexComputerUseConfig, t as codexAppServerStartOptionsKey, u as CODEX_SESSION_OVERRIDABLE_LAYER_TYPES } from "./config-options-CZmH25Xq.mjs";
-import { d as resolveMacOSDesktopCodexBundledMarketplaceCandidates, f as resolveMacOSDesktopCodexComputerUseServiceAppCandidates, i as resolveManagedCodexNativeCommand, l as resolveFirstExistingMacOSDesktopCodexBundledMarketplacePath, r as resolveManagedCodexAppServerStartOptions, t as isManagedCodexDesktopCommand, u as resolveMacOSDesktopCodexAppPathCandidates } from "./managed-binary-DwC9wxch.mjs";
-import { A as waitForCodexDesktopGeneration, C as retirePendingSharedClientEntryIfUnclaimed, D as waitForUnclaimedSharedClientStartup, _ as observeSharedClientAcquire, a as readCodexCliAuthFileApiKey, b as releaseSharedClientEntry, c as resolveCodexAppServerPreparedApiKeyCacheKey, d as getCurrentSharedClientEntry, f as getOrCreateSharedClientEntry, g as observeAcquire, h as notifyDesktopGenerationDrainChecks, i as fingerprintTokenAuthProfileCacheKey, j as readCodexDesktopArtifactTreeFingerprint, k as isCodexDesktopGenerationCurrent, l as closeSharedClientEntryIfUnclaimed, n as CODEX_AUTH_JSON_FILENAME, o as readFirstNonEmptyEnv, p as getSharedCodexAppServerClientState, r as fingerprintApiKeyAuthProfileCacheKey, s as resolveCodexAppServerFallbackApiKeyCacheKey, t as CODEX_APP_SERVER_API_KEY_ENV_VARS, u as createCodexAppServerStartupLifetime, v as ownCodexStartup, w as retireSharedCodexAppServerClientIfCurrent, x as retainSharedClientEntry, y as recordSharedClientAcquireBoundary } from "./auth-cache-key-DrieYJUQ.mjs";
-import { n as resolveCodexAppServerSpawnEnv } from "./transport-stdio-lgeKKHyw.mjs";
+import { d as resolveMacOSDesktopCodexBundledMarketplaceCandidates, f as resolveMacOSDesktopCodexComputerUseServiceAppCandidates, i as resolveManagedCodexNativeCommand, l as resolveFirstExistingMacOSDesktopCodexBundledMarketplacePath, r as resolveManagedCodexAppServerStartOptions, t as isManagedCodexDesktopCommand, u as resolveMacOSDesktopCodexAppPathCandidates } from "./managed-binary-Boj8_lWV.mjs";
+import { A as waitForCodexDesktopGeneration, C as retirePendingSharedClientEntryIfUnclaimed, D as waitForUnclaimedSharedClientStartup, _ as observeSharedClientAcquire, a as readCodexCliAuthFileApiKey, b as releaseSharedClientEntry, c as resolveCodexAppServerPreparedApiKeyCacheKey, d as getCurrentSharedClientEntry, f as getOrCreateSharedClientEntry, g as observeAcquire, h as notifyDesktopGenerationDrainChecks, i as fingerprintTokenAuthProfileCacheKey, j as readCodexDesktopArtifactTreeFingerprint, k as isCodexDesktopGenerationCurrent, l as closeSharedClientEntryIfUnclaimed, n as CODEX_AUTH_JSON_FILENAME, o as readFirstNonEmptyEnv, p as getSharedCodexAppServerClientState, r as fingerprintApiKeyAuthProfileCacheKey, s as resolveCodexAppServerFallbackApiKeyCacheKey, t as CODEX_APP_SERVER_API_KEY_ENV_VARS, u as createCodexAppServerStartupLifetime, v as ownCodexStartup, w as retireSharedCodexAppServerClientIfCurrent, x as retainSharedClientEntry, y as recordSharedClientAcquireBoundary } from "./auth-cache-key-8VTsPn2f.mjs";
+import { n as resolveCodexAppServerSpawnEnv } from "./transport-stdio-BsXQmXll.mjs";
 import { n as CodexAppServerAuthProfileUnavailableError, r as formatCodexAuthProfileUnavailableMessage } from "./auth-profile-recovery-BREezV0L.mjs";
 import { a as codexPrewriteRejectionCause } from "./rpc-error-C98SHchT.mjs";
 import { i as withTimeout } from "./timeout-D0mEWSGG.mjs";
 import { n as readCodexSessionMeta } from "./session-catalog-provenance-CmsOE5mh.mjs";
-import { n as observeCodexCatalogClient } from "./session-catalog-events-CpEyDv0D.mjs";
-import { n as resolveCodexAppServerRuntimeOptions } from "./config-runtime-DGB1-VbB.mjs";
+import { n as observeCodexCatalogClient } from "./session-catalog-events-C8i0HBz5.mjs";
+import { n as resolveCodexAppServerRuntimeOptions } from "./config-runtime-BUH-IDVE.mjs";
 import { a as resolveCodexAppServerAuthProfileStore, i as resolveCodexAppServerAuthProfileIdForAgent, r as resolveCodexAppServerAuthProfileId, t as isCodexAppServerNativeAuthProfile } from "./auth-profile-CgHQ8Vot.mjs";
 import { i as isCodexResponsesOAuthCredential, n as createCodexResponsesOAuth, o as resolveCodexResponsesOAuthProfileFingerprint, r as isCodexResponsesOAuth, t as CODEX_RESPONSES_OAUTH_PROVIDER } from "./responses-oauth-twnuTaAa.mjs";
-import { N as isUnsupportedCodexAppServerVersionError, t as CodexAppServerClient } from "./client-BM97zH3z.mjs";
-import { n as isCodexWebSocketOpenFailure } from "./transport-websocket-CEBjEtFP.mjs";
-import { t as __exportAll } from "./session-binding-sidecars-DijNZb31.mjs";
+import { N as isUnsupportedCodexAppServerVersionError, t as CodexAppServerClient } from "./client-BTWv2cJe.mjs";
+import { n as isCodexWebSocketOpenFailure } from "./transport-websocket-B5mq2Iq2.mjs";
+import { t as __exportAll } from "./session-binding-sidecars-CAHe3enw.mjs";
 import { asOptionalRecord, isRecord } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { createHash, randomUUID } from "node:crypto";
 import { isDeepStrictEqual } from "node:util";
@@ -2340,8 +2340,10 @@ function supportsInferenceEnvironment(native) {
 	if (bypasses.some((entry) => ![
 		"127.0.0.1",
 		"localhost",
+		"localhost.",
 		"::1",
-		"[::1]"
+		"[::1]",
+		"127.0.0.0/8"
 	].includes(entry))) return false;
 	if ((http || all) && !bypasses.includes("127.0.0.1")) return false;
 	return /^https?:\/\//.test(https ?? all ?? "");
@@ -2540,8 +2542,8 @@ async function prepareCodexInferenceRoute(params) {
 				throw new Error("Codex inference route limit reached; start a fresh managed native connection before retrying.");
 			}
 			pending = Promise.all([
-				import("./inference-proxy-DSnaS-uS.mjs"),
-				import("./native-subagent-monitor-CJaIve3h.mjs").then((n) => n.n),
+				import("./inference-proxy-BZgN5W8m.mjs"),
+				import("./native-subagent-monitor-CuNglHrq.mjs").then((n) => n.n),
 				import("./inference-dispatch-CO6tTs4q.mjs")
 			]).then(([{ createCodexInferenceProxy }, native, { createCodexInferenceModelBinding }]) => {
 				assertClient();
@@ -3356,7 +3358,7 @@ async function startInitializedCodexAppServerClientOnce(params) {
 		} finally {
 			artifactDrain?.cancel();
 		}
-		const runtimeArtifactModule = params.runtimeArtifactMode ? await import("./runtime-artifact-CCPLKFGR.mjs") : void 0;
+		const runtimeArtifactModule = params.runtimeArtifactMode ? await import("./runtime-artifact-Ch7fCcgJ.mjs") : void 0;
 		const runtimeArtifactBeforeStart = runtimeArtifactModule ? await runtimeArtifactModule.captureCodexAppServerRuntimeArtifactBeforeStart({
 			startOptions,
 			spawnIdentity: resolveCodexAppServerSpawnIdentity(startOptions),

package/dist/.setup/{side-question-ZVehuPZn.mjs → side-question-GmfBHNHK.mjs}

@@ -1,29 +1,29 @@
 import { i as isJsonObject } from "./protocol-CANUwXJ3.mjs";
-import { m as sessionBindingIdentity } from "./session-binding-record-C2kDBZhx.mjs";
+import { m as sessionBindingIdentity } from "./session-binding-record-O62ZRFhy.mjs";
 import { c as withMcpElicitationsApprovalPolicy, d as readCodexRequirementsToml, n as hasCodexMcpToolApprovalOverrides, s as shouldAutoApproveCodexAppServerApprovals } from "./config-security-DpkGNy5T.mjs";
 import { c as isCodexPairedNodeRemoteExecPlacementSandbox, d as readCodexPluginConfig, l as isCodexRemoteExecPlacementSandbox, u as isCodexSandboxExecServerEnabled } from "./config-parsing-CVK2Q463.mjs";
 import { i as resolveCodexAppServerHomeScope, l as resolveCodexModelBackedReviewerPolicyContext } from "./config-options-CZmH25Xq.mjs";
 import { n as formatCodexUsageLimitErrorMessage } from "./rate-limits-CI8pTPqL.mjs";
-import { i as resolveCodexBindingAppServerConnection, r as requireCodexSupervisionModelSelection } from "./binding-connection-C0t9TBX_.mjs";
-import { n as canUseCodexModelBackedApprovalsReviewerForModel, r as resolveOpenClawExecPolicyForCodexAppServer } from "./config-LQemoqTL.mjs";
-import { Q as readRecentCodexRateLimits, at as resolveCodexAppServerPreparedAuthHandoff, b as withLeasedCodexAppServerClientStartSelectionRetry, c as getLeasedSharedCodexAppServerClient, m as releaseCodexAppServerClientLease } from "./shared-client-AdQX0Tdq.mjs";
-import { E as resolveDynamicToolCallTimeoutMs, O as toCodexDynamicToolProtocolResponse, T as handleDynamicToolCallWithTimeout, _ as assertCodexTurnStartResponse, a as isCodexAppServerIndeterminateRequestCancellationError, k as resolveCodexToolAbortTerminalReason, m as assertCodexThreadForkResponse, r as isCodexAppServerApprovalRequest, w as createCodexElicitationResponse, y as readCodexDynamicToolCallParams } from "./client-BM97zH3z.mjs";
-import { d as terminateCodexBackgroundTerminals, f as unsubscribeCodexThreadBestEffort, l as retireUnsafeCodexTurnClientBestEffort, s as interruptCodexTurnAndWaitBestEffort } from "./attempt-client-cleanup-jWVRH043.mjs";
-import { t as CodexEphemeralTurn } from "./ephemeral-turn-DeppK8zz.mjs";
-import { d as mergeCodexThreadConfigs, f as refreshCodexPluginAppApprovalPolicy } from "./project-doc-thread-config-D_sWbxFR.mjs";
+import { i as resolveCodexBindingAppServerConnection, r as requireCodexSupervisionModelSelection } from "./binding-connection-BIo1-hoT.mjs";
+import { n as canUseCodexModelBackedApprovalsReviewerForModel, r as resolveOpenClawExecPolicyForCodexAppServer } from "./config-d0gOFYEk.mjs";
+import { Q as readRecentCodexRateLimits, at as resolveCodexAppServerPreparedAuthHandoff, b as withLeasedCodexAppServerClientStartSelectionRetry, c as getLeasedSharedCodexAppServerClient, m as releaseCodexAppServerClientLease } from "./shared-client-Bo9MCCKj.mjs";
+import { E as resolveDynamicToolCallTimeoutMs, O as toCodexDynamicToolProtocolResponse, T as handleDynamicToolCallWithTimeout, _ as assertCodexTurnStartResponse, a as isCodexAppServerIndeterminateRequestCancellationError, k as resolveCodexToolAbortTerminalReason, m as assertCodexThreadForkResponse, r as isCodexAppServerApprovalRequest, w as createCodexElicitationResponse, y as readCodexDynamicToolCallParams } from "./client-BTWv2cJe.mjs";
+import { d as terminateCodexBackgroundTerminals, f as unsubscribeCodexThreadBestEffort, l as retireUnsafeCodexTurnClientBestEffort, s as interruptCodexTurnAndWaitBestEffort } from "./attempt-client-cleanup-BmPBqnW3.mjs";
+import { t as CodexEphemeralTurn } from "./ephemeral-turn-B1Na_xCj.mjs";
+import { d as mergeCodexThreadConfigs, f as refreshCodexPluginAppApprovalPolicy } from "./project-doc-thread-config-BYFXSVGk.mjs";
 import { n as resolveCodexAppServerReasoningEffort, t as readCodexSupportedReasoningEfforts } from "./reasoning-effort-CS9kKWB9.mjs";
-import { h as resolveCodexWebSearchPlan, r as buildCodexRuntimeThreadConfig, z as resolveCodexDynamicToolsLoading } from "./thread-requests-DjyDmCo4.mjs";
-import { i as resolveCodexSessionBinding } from "./session-binding-BDnNz-Co.mjs";
+import { h as resolveCodexWebSearchPlan, r as buildCodexRuntimeThreadConfig, z as resolveCodexDynamicToolsLoading } from "./thread-requests-pX9_RXpU.mjs";
+import { i as resolveCodexSessionBinding } from "./session-binding-_RE7vtVN.mjs";
 import { i as resolveCodexAppServerThreadModelSelection, t as CODEX_NATIVE_PERSONALITY_NONE } from "./thread-model-selection-DcVebr8N.mjs";
-import { t as resolveCodexNativeExecutionBlock } from "./sandbox-guard-Cf9XMRrg.mjs";
-import { i as assertCodexSupervisionThreadLineage, n as CodexThreadPolicyHandoffError, o as refreshCodexThreadPolicy } from "./thread-policy-Dp4CQjdL.mjs";
+import { t as resolveCodexNativeExecutionBlock } from "./sandbox-guard-CwOc36_1.mjs";
+import { i as assertCodexSupervisionThreadLineage, n as CodexThreadPolicyHandoffError, o as refreshCodexThreadPolicy } from "./thread-policy-BFLbIpIt.mjs";
 import { o as runCodexCleanupStep } from "./run-attempt-lifecycle-DN-ATDp9.mjs";
-import { a as resolveCodexExternalSandboxPolicyForOpenClawSandbox, c as shouldEnableCodexAppServerNativeToolSurface, l as shouldRequireCodexSandboxExecServerEnvironment, o as resolveCodexMessageToolProvider, s as resolveCodexSandboxEnvironmentSelection, t as buildDynamicTools } from "./dynamic-tool-build-Dp4v52Kl.mjs";
-import { a as buildCodexNativeHookRelayDisabledConfig, i as buildCodexNativeHookRelayConfig, l as resolveCodexNativeHookRelayEvents, u as resolveCodexNativeHookRelayTtlMs } from "./native-hook-relay-Ctyky2Qt.mjs";
+import { a as resolveCodexExternalSandboxPolicyForOpenClawSandbox, c as shouldEnableCodexAppServerNativeToolSurface, l as shouldRequireCodexSandboxExecServerEnvironment, o as resolveCodexMessageToolProvider, s as resolveCodexSandboxEnvironmentSelection, t as buildDynamicTools } from "./dynamic-tool-build-OWTT0wP-.mjs";
+import { a as buildCodexNativeHookRelayDisabledConfig, i as buildCodexNativeHookRelayConfig, l as resolveCodexNativeHookRelayEvents, u as resolveCodexNativeHookRelayTtlMs } from "./native-hook-relay-VHeLdZXU.mjs";
 import { i as resolveCodexSessionPermissionCwd, n as applyCodexSessionPermissionPolicy, r as resolveCodexEffectiveSessionPermissionPolicy, t as CODEX_SESSION_PERMISSION_EXEC_MODES } from "./session-permission-policy-C7kYxPGd.mjs";
-import { a as handleCodexAppServerApprovalRequest, c as createCodexNativePreToolUseFailureBuffer, d as buildCodexTemporalAdditionalContext, g as buildCodexUserInput, i as createCodexDynamicToolDiagnostics, o as ensureCodexSandboxExecServerEnvironment, r as routeCodexAppServerElicitationRequest, s as releaseCodexSandboxExecServerEnvironment, t as createCodexDynamicToolBridge, y as CodexNativeToolLifecycleProjector } from "./dynamic-tools-C1Egdhrx.mjs";
-import { t as resolveCodexAppServerForModelProvider } from "./app-server-policy-V8zuN8q_.mjs";
-import { n as resolveCodexProviderWebSearchSupportForClient } from "./provider-capabilities-BCZeV7xZ.mjs";
+import { a as handleCodexAppServerApprovalRequest, c as createCodexNativePreToolUseFailureBuffer, d as buildCodexTemporalAdditionalContext, g as buildCodexUserInput, i as createCodexDynamicToolDiagnostics, o as ensureCodexSandboxExecServerEnvironment, r as routeCodexAppServerElicitationRequest, s as releaseCodexSandboxExecServerEnvironment, t as createCodexDynamicToolBridge, y as CodexNativeToolLifecycleProjector } from "./dynamic-tools-CygReZGj.mjs";
+import { t as resolveCodexAppServerForModelProvider } from "./app-server-policy-CF-JwGUD.mjs";
+import { n as resolveCodexProviderWebSearchSupportForClient } from "./provider-capabilities-BIyUe_cz.mjs";
 import { readStringField } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { randomUUID } from "node:crypto";
 import { isDeepStrictEqual } from "node:util";

package/dist/.setup/{source-BszpKEvi.mjs → source-C4Al9cJx.mjs}

@@ -1,8 +1,8 @@
 import { a as defaultCodexAppInventoryCache, r as buildCodexPluginAppCacheKey } from "./plugin-app-cache-key-Bg9DbDI6.mjs";
-import { a as withCodexAppServerJsonClient } from "./request-XC1RG34l.mjs";
-import { a as marketplaceRef, o as pluginReadParams, r as isOpenAiCuratedMarketplaceName, u as CODEX_PLUGINS_MARKETPLACE_NAME } from "./plugin-inventory-OhiCoyPH.mjs";
-import "./config-LQemoqTL.mjs";
-import { t as __exportAll } from "./session-binding-sidecars-DijNZb31.mjs";
+import { a as withCodexAppServerJsonClient } from "./request-6bus8ebp.mjs";
+import { a as marketplaceRef, o as pluginReadParams, r as isOpenAiCuratedMarketplaceName, u as CODEX_PLUGINS_MARKETPLACE_NAME } from "./plugin-inventory-CZLnMaxf.mjs";
+import "./config-d0gOFYEk.mjs";
+import { t as __exportAll } from "./session-binding-sidecars-CAHe3enw.mjs";
 import { asNonArrayRecord } from "openclaw/plugin-sdk/string-coerce-runtime";
 import path from "node:path";
 import os from "node:os";

package/dist/.setup/{thread-lifecycle-run-DezS4UNT.mjs → thread-lifecycle-run-avZbRAjm.mjs}

@@ -1,11 +1,11 @@
 import { i as isJsonObject, r as flattenCodexDynamicToolFunctions } from "./protocol-CANUwXJ3.mjs";
 import { n as matchesPendingSupervisionBranch } from "./session-binding-record-codec-CWQXr9os.mjs";
-import { m as sessionBindingIdentity, n as assertCodexBindingMayBeReplaced } from "./session-binding-record-C2kDBZhx.mjs";
+import { m as sessionBindingIdentity, n as assertCodexBindingMayBeReplaced } from "./session-binding-record-O62ZRFhy.mjs";
 import { l as fingerprintCodexPolicy } from "./config-security-DpkGNy5T.mjs";
 import { f as resolveCodexPluginsPolicy } from "./config-parsing-CVK2Q463.mjs";
 import { n as resolveCodexAppServerLocalHomeDir, t as resolveCodexAppServerHomeDir } from "./auth-start-options-BPIPeEX8.mjs";
 import { d as readCodexEffectiveConfig, s as assertCodexModelBackedReviewerEffectiveConfig, u as CODEX_SESSION_OVERRIDABLE_LAYER_TYPES } from "./config-options-CZmH25Xq.mjs";
-import { S as retainSharedCodexAppServerClientByInstanceId, d as getCurrentSharedClientEntry } from "./auth-cache-key-DrieYJUQ.mjs";
+import { S as retainSharedCodexAppServerClientByInstanceId, d as getCurrentSharedClientEntry } from "./auth-cache-key-8VTsPn2f.mjs";
 import { t as withCodexAppServerThreadMutation } from "./thread-ownership-queue-CeyYScUC.mjs";
 import { o as isCodexAppServerOverloadError, r as CodexAppServerRpcError, s as isCodexThreadReadMissingError } from "./rpc-error-C98SHchT.mjs";
 import { t as codexCatalogHomeId } from "./session-catalog-home-id-vlih0B_g.mjs";
@@ -13,27 +13,27 @@ import { r as withAbortableTimeout } from "./timeout-D0mEWSGG.mjs";
 import { t as projectBoundedCodexThreadHistory } from "./transcript-history-projection-DfKcoZCB.mjs";
 import { a as defaultCodexAppInventoryCache, t as buildCodexAppServerConnectionFingerprint } from "./plugin-app-cache-key-Bg9DbDI6.mjs";
 import { n as readCodexSessionMeta } from "./session-catalog-provenance-CmsOE5mh.mjs";
-import { t as assertCodexSessionRuntimeOwnership } from "./binding-connection-C0t9TBX_.mjs";
-import { c as resolveRecoverableCodexPluginConfigKeys } from "./plugin-inventory-OhiCoyPH.mjs";
-import "./config-LQemoqTL.mjs";
+import { t as assertCodexSessionRuntimeOwnership } from "./binding-connection-BIo1-hoT.mjs";
+import { c as resolveRecoverableCodexPluginConfigKeys } from "./plugin-inventory-CZLnMaxf.mjs";
+import "./config-d0gOFYEk.mjs";
 import { c as resolveCodexContextEngineProjectionMaxChars } from "./context-engine-projection-ps-yn_ci.mjs";
 import { n as normalizeCodexAppServerBindingModelProvider } from "./auth-profile-CgHQ8Vot.mjs";
-import { A as bindCodexInferenceThread, B as isCodexAppServerClientRuntimeLive, C as CodexThreadBindingConflictError, F as consumeCodexAppServerLiveThread, H as isCodexAppServerLiveThreadClaimed, M as getCodexInferenceThreadQualification, N as prepareCodexInferenceThreadConfig, S as CodexAdoptedThreadActiveError, T as CodexThreadStartRequestError, U as isCodexAppServerLiveThreadProtected, V as isCodexAppServerLiveThreadBackgroundOnly, X as unsubscribeCodexAppServerLiveThread, et as createCodexEphemeralThreadPolicy, j as getCodexInferenceThread, k as assertCodexInferenceRouteConfig, n as captureCodexAppServerClientLifetime, nt as wasCodexAppServerThreadClosed, q as releaseCodexAppServerLiveThread, tt as isCodexAppServerThreadTerminalNotification, w as CodexThreadClientReplacementError, z as hasCodexAppServerSiblingThreadWork } from "./shared-client-AdQX0Tdq.mjs";
-import { C as resolveCodexThreadRolloutPath, F as getCodexAppServerClientInstanceId, L as resolveCodexAppServerClientInstanceId, S as readSupervisionResponseThreadId, c as isCodexAppServerRequestTimeoutError, g as assertCodexThreadStartResponse, m as assertCodexThreadForkResponse, p as assertCodexThreadAcceptsDirectInput, v as assertExactSupervisionModelSelection } from "./client-BM97zH3z.mjs";
-import { r as hasCodexAppServerSiblingRouteWork } from "./turn-router-DnfbVPvu.mjs";
-import { f as unsubscribeCodexThreadBestEffort, l as retireUnsafeCodexTurnClientBestEffort, n as CODEX_APP_SERVER_UNSUBSCRIBE_TIMEOUT_MS, o as closeCodexStartupClientBestEffort, r as CodexAppServerUnsafeSubscriptionError } from "./attempt-client-cleanup-jWVRH043.mjs";
-import { a as buildCodexPluginThreadConfigInputFingerprint, c as buildPluginAppPolicyContext, d as mergeCodexThreadConfigs, i as buildCodexPluginThreadConfig, l as disableUnlistedCodexApps, m as buildCodexAppApprovalOverrides, n as mergeCodexNativeProjectDocThreadConfig, o as buildCodexPluginThreadConfigTimeoutFallback, p as shouldBuildCodexPluginThreadConfig, r as buildCodexPluginAppsConfigPatchFromPolicyContext, u as isCodexPluginThreadBindingStale } from "./project-doc-thread-config-D_sWbxFR.mjs";
-import { A as isTransientWebSearchRestriction, C as fingerprintEnvironmentSelection, D as readActiveCodexTurnIdsFromResume, E as legacyFingerprintUserMcpServersConfigPatch, I as isMessageOnlyCodexSourceReply, L as isSystemAgentOnlyCodexDynamicToolAllowlist, M as shouldRotateCodexAppServerBindingForRuntime, N as shouldRotateCodexGpt56MultiAgentBinding, O as shouldStartTransientNoToolThread, S as fingerprintCodexThreadConfig, T as fingerprintUserMcpServersConfigPatch, _ as buildDeveloperInstructions, b as codexDynamicToolsFingerprint, c as codexThreadSandboxOrPermissions, d as readCodexManagedRequirementsFingerprint, f as resolveCodexThreadApprovalsReviewer, g as mergeCodexNativeShellEnvironment, h as resolveCodexWebSearchPlan, i as buildCodexRuntimeThreadConfigForRun, j as shouldRecheckRecoverablePluginBinding, n as buildCodexRingZeroThreadConfigPatch, o as buildThreadResumeParams, p as attestCodexRestrictedToolSurfaceMcpServersDisabled, s as buildThreadStartParams, t as assertCodexManagedRequirementsDoNotOverrideToolPolicy, u as readCodexInheritedMcpServerNames, v as areCodexDynamicToolFingerprintsCompatible, w as fingerprintJsonObject, x as codexLegacyDynamicToolsFingerprint, y as areUserMcpServersFingerprintsCompatible } from "./thread-requests-DjyDmCo4.mjs";
-import { i as resolveCodexSessionBinding, o as hashCodexAppServerBindingFingerprint } from "./session-binding-BDnNz-Co.mjs";
+import { A as bindCodexInferenceThread, B as isCodexAppServerClientRuntimeLive, C as CodexThreadBindingConflictError, F as consumeCodexAppServerLiveThread, H as isCodexAppServerLiveThreadClaimed, M as getCodexInferenceThreadQualification, N as prepareCodexInferenceThreadConfig, S as CodexAdoptedThreadActiveError, T as CodexThreadStartRequestError, U as isCodexAppServerLiveThreadProtected, V as isCodexAppServerLiveThreadBackgroundOnly, X as unsubscribeCodexAppServerLiveThread, et as createCodexEphemeralThreadPolicy, j as getCodexInferenceThread, k as assertCodexInferenceRouteConfig, n as captureCodexAppServerClientLifetime, nt as wasCodexAppServerThreadClosed, q as releaseCodexAppServerLiveThread, tt as isCodexAppServerThreadTerminalNotification, w as CodexThreadClientReplacementError, z as hasCodexAppServerSiblingThreadWork } from "./shared-client-Bo9MCCKj.mjs";
+import { C as resolveCodexThreadRolloutPath, F as getCodexAppServerClientInstanceId, L as resolveCodexAppServerClientInstanceId, S as readSupervisionResponseThreadId, c as isCodexAppServerRequestTimeoutError, g as assertCodexThreadStartResponse, m as assertCodexThreadForkResponse, p as assertCodexThreadAcceptsDirectInput, v as assertExactSupervisionModelSelection } from "./client-BTWv2cJe.mjs";
+import { r as hasCodexAppServerSiblingRouteWork } from "./turn-router-Ba0-h2NE.mjs";
+import { f as unsubscribeCodexThreadBestEffort, l as retireUnsafeCodexTurnClientBestEffort, n as CODEX_APP_SERVER_UNSUBSCRIBE_TIMEOUT_MS, o as closeCodexStartupClientBestEffort, r as CodexAppServerUnsafeSubscriptionError } from "./attempt-client-cleanup-BmPBqnW3.mjs";
+import { a as buildCodexPluginThreadConfigInputFingerprint, c as buildPluginAppPolicyContext, d as mergeCodexThreadConfigs, i as buildCodexPluginThreadConfig, l as disableUnlistedCodexApps, m as buildCodexAppApprovalOverrides, n as mergeCodexNativeProjectDocThreadConfig, o as buildCodexPluginThreadConfigTimeoutFallback, p as shouldBuildCodexPluginThreadConfig, r as buildCodexPluginAppsConfigPatchFromPolicyContext, u as isCodexPluginThreadBindingStale } from "./project-doc-thread-config-BYFXSVGk.mjs";
+import { A as isTransientWebSearchRestriction, C as fingerprintEnvironmentSelection, D as readActiveCodexTurnIdsFromResume, E as legacyFingerprintUserMcpServersConfigPatch, I as isMessageOnlyCodexSourceReply, L as isSystemAgentOnlyCodexDynamicToolAllowlist, M as shouldRotateCodexAppServerBindingForRuntime, N as shouldRotateCodexGpt56MultiAgentBinding, O as shouldStartTransientNoToolThread, S as fingerprintCodexThreadConfig, T as fingerprintUserMcpServersConfigPatch, _ as buildDeveloperInstructions, b as codexDynamicToolsFingerprint, c as codexThreadSandboxOrPermissions, d as readCodexManagedRequirementsFingerprint, f as resolveCodexThreadApprovalsReviewer, g as mergeCodexNativeShellEnvironment, h as resolveCodexWebSearchPlan, i as buildCodexRuntimeThreadConfigForRun, j as shouldRecheckRecoverablePluginBinding, n as buildCodexRingZeroThreadConfigPatch, o as buildThreadResumeParams, p as attestCodexRestrictedToolSurfaceMcpServersDisabled, s as buildThreadStartParams, t as assertCodexManagedRequirementsDoNotOverrideToolPolicy, u as readCodexInheritedMcpServerNames, v as areCodexDynamicToolFingerprintsCompatible, w as fingerprintJsonObject, x as codexLegacyDynamicToolsFingerprint, y as areUserMcpServersFingerprintsCompatible } from "./thread-requests-pX9_RXpU.mjs";
+import { i as resolveCodexSessionBinding, o as hashCodexAppServerBindingFingerprint } from "./session-binding-_RE7vtVN.mjs";
 import { i as resolveCodexAppServerThreadModelSelection, n as resolveCodexAppServerModelProvider } from "./thread-model-selection-DcVebr8N.mjs";
-import { c as withExclusiveCodexAppServerThread, r as retainCodexAppServerBindingSubscription, t as isSameCodexAppServerThreadOwner } from "./thread-ownership-OXzPB_RV.mjs";
-import { a as refreshCodexThreadInstructions, i as assertCodexSupervisionThreadLineage, n as CodexThreadPolicyHandoffError, o as refreshCodexThreadPolicy, r as assertAdoptedCodexThreadResumeAllowed, t as CodexIncognitoPolicyChangeError } from "./thread-policy-Dp4CQjdL.mjs";
-import { t as resumeCodexAppServerThread } from "./thread-resume-8YKfRoX6.mjs";
+import { c as withExclusiveCodexAppServerThread, r as retainCodexAppServerBindingSubscription, t as isSameCodexAppServerThreadOwner } from "./thread-ownership-C5Hpc-Q1.mjs";
+import { a as refreshCodexThreadInstructions, i as assertCodexSupervisionThreadLineage, n as CodexThreadPolicyHandoffError, o as refreshCodexThreadPolicy, r as assertAdoptedCodexThreadResumeAllowed, t as CodexIncognitoPolicyChangeError } from "./thread-policy-BFLbIpIt.mjs";
+import { t as resumeCodexAppServerThread } from "./thread-resume-LBLXiIEh.mjs";
 import { r as readCodexMcpToolConnectorId } from "./mcp-tool-metadata-_sawBkIh.mjs";
-import { n as disableCodexPluginThreadConfig } from "./dynamic-tool-build-Dp4v52Kl.mjs";
-import { n as CodexManagedHooksOnlyError, r as assertCodexNativeHookRelayAllowed } from "./native-hook-relay-Ctyky2Qt.mjs";
+import { n as disableCodexPluginThreadConfig } from "./dynamic-tool-build-OWTT0wP-.mjs";
+import { n as CodexManagedHooksOnlyError, r as assertCodexNativeHookRelayAllowed } from "./native-hook-relay-VHeLdZXU.mjs";
 import { t as defaultCodexPluginMetadataCache } from "./plugin-metadata-cache-Bi8TAPwX.mjs";
-import { a as discardUnattestedCodexPluginThread, i as checkCodexThreadAppAvailability, n as resolveCodexNativeSkillIsolation, o as hasCodexNativeToolCatalog, r as attestCodexThreadToolSurface, s as loadCodexNativeToolCatalog, t as applyCodexNativeSkillIsolation } from "./native-skill-isolation-C4XYLm33.mjs";
+import { a as discardUnattestedCodexPluginThread, i as checkCodexThreadAppAvailability, n as resolveCodexNativeSkillIsolation, o as hasCodexNativeToolCatalog, r as attestCodexThreadToolSurface, s as loadCodexNativeToolCatalog, t as applyCodexNativeSkillIsolation } from "./native-skill-isolation--6M-3BWV.mjs";
 import { asOptionalRecord, normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
 import crypto from "node:crypto";
 import { isDeepStrictEqual } from "node:util";
@@ -1224,6 +1224,7 @@ async function releaseCodexBoundLiveThread(options) {
 	const client = previous?.client ?? options.client;
 	let threadClosed;
 	let stopWatching;
+	let stopReading;
 	if (previous) {
 		threadClosed = new Promise((resolve) => {
 			stopWatching = client.addNotificationHandler((notification) => {
@@ -1248,8 +1249,28 @@ async function releaseCodexBoundLiveThread(options) {
 	} finally {
 		try {
 			const retiredExit = previous?.release(!isCodexAppServerLiveThreadClaimed(client, options.threadId) && !isCodexAppServerLiveThreadProtected(client, options.threadId));
-			if (retiredExit) await options.lifecycleTiming.measure("retired-thread-runtime-release", () => racePromiseWithAbortSignal(threadClosed ? Promise.race([retiredExit, threadClosed]) : retiredExit, options.signal, codexThreadLifecycleAbortError));
+			if (retiredExit) {
+				const stopped = threadClosed ? [retiredExit, threadClosed] : [retiredExit];
+				if (!client.getCloseError() && !wasCodexAppServerThreadClosed(client, options.threadId)) {
+					const readController = new AbortController();
+					stopReading = () => readController.abort();
+					const signal = options.signal ? AbortSignal.any([options.signal, readController.signal]) : readController.signal;
+					stopped.push(client.request("thread/read", {
+						threadId: options.threadId,
+						includeTurns: false
+					}, {
+						signal,
+						assertCurrent: options.assertCurrent,
+						withCurrent: options.withCurrent
+					}).then(({ thread }) => {
+						if (thread.id !== options.threadId) throw new Error("Codex returned another thread during retired-owner handoff");
+						return thread.status?.type === "notLoaded" ? void 0 : retiredExit;
+					}, () => retiredExit));
+				}
+				await options.lifecycleTiming.measure("retired-thread-runtime-release", () => racePromiseWithAbortSignal(Promise.race(stopped), options.signal, codexThreadLifecycleAbortError));
+			}
 		} finally {
+			stopReading?.();
 			stopWatching?.();
 		}
 	}

package/dist/.setup/{thread-ownership-OXzPB_RV.mjs → thread-ownership-C5Hpc-Q1.mjs}

@@ -1,8 +1,8 @@
-import { S as retainSharedCodexAppServerClientByInstanceId } from "./auth-cache-key-DrieYJUQ.mjs";
+import { S as retainSharedCodexAppServerClientByInstanceId } from "./auth-cache-key-8VTsPn2f.mjs";
 import { t as withCodexAppServerThreadMutation } from "./thread-ownership-queue-CeyYScUC.mjs";
-import { H as isCodexAppServerLiveThreadClaimed, J as retainCodexAppServerLiveThread, q as releaseCodexAppServerLiveThread } from "./shared-client-AdQX0Tdq.mjs";
-import { f as unsubscribeCodexThreadBestEffort, o as closeCodexStartupClientBestEffort, r as CodexAppServerUnsafeSubscriptionError } from "./attempt-client-cleanup-jWVRH043.mjs";
-import { t as __exportAll } from "./session-binding-sidecars-DijNZb31.mjs";
+import { H as isCodexAppServerLiveThreadClaimed, J as retainCodexAppServerLiveThread, q as releaseCodexAppServerLiveThread } from "./shared-client-Bo9MCCKj.mjs";
+import { f as unsubscribeCodexThreadBestEffort, o as closeCodexStartupClientBestEffort, r as CodexAppServerUnsafeSubscriptionError } from "./attempt-client-cleanup-BmPBqnW3.mjs";
+import { t as __exportAll } from "./session-binding-sidecars-CAHe3enw.mjs";
 import { createDeferred } from "openclaw/plugin-sdk/extension-shared";
 import { runWithAsyncWorkResources } from "openclaw/plugin-sdk/agent-harness-tool-runtime";
 //#region extensions/codex/src/app-server/thread-ownership.ts