@openclaw/codex 2026.10.7 → 2026.10.9

package/README.md

@@ -44,6 +44,8 @@ When assembled context bootstraps a Codex thread, redacted tool payloads retain
 
 Settled-turn finalization uses the same configured Codex App Server transport as the supervised conversation. Remote websocket App Server configurations stay on their configured transport. Managed user-home stdio launches running inside an Agent home, and not through the proxy launcher, use a private stdio side turn for native-tool isolation. The bounded finalizer preserves the selected model, provider, and native authorization returned by Codex, and rejects native tool evidence outside the finalization contract. It may mirror a final answer after completed tool work; it does not diagnose why a model omitted a visible final message.
 
+An internal system turn that mirrors no prompt and has no transcript recorder, such as the stranded-reply retry after a `message_tool_only` final, anchors its evidence at the turn's first mirrored row; the user turn that produced it stays prior context and is never borrowed as the turn's prompt.
+
 When settled-turn recovery rejects history, the `codex settled-turn finalization context capture failed` warning includes a stable `reason`, such as `item_limit`, `byte_limit`, `field_limit`, `unsupported_user_image`, or `snapshot_invalidated`. Unknown failures use `history_read_failed`. The warning excludes transcript content and exception text. Rejected history remains unavailable for finalization, and completed actions are never replayed.
 
 See the [Codex harness](https://docs.openclaw.ai/plugins/codex-harness) and [Codex supervision](https://docs.openclaw.ai/plugins/codex-supervision) guides.

package/dist/.setup/{account-usage-runtime-gzHf_Qtb.mjs → account-usage-runtime-DAt_3QG0.mjs}

@@ -1,8 +1,8 @@
 import { n as isCodexAppServerProxyLaunch } from "./launch-args-DbFCehO7.mjs";
 import { t as buildCodexAppServerUsageSnapshot } from "./rate-limits-CI8pTPqL.mjs";
-import { t as readCodexAppServerUsage } from "./request-XC1RG34l.mjs";
-import "./config-LQemoqTL.mjs";
-import { n as resolveCodexAppServerRuntimeOptions } from "./config-runtime-DGB1-VbB.mjs";
+import { t as readCodexAppServerUsage } from "./request-ufWmJNN1.mjs";
+import "./config-d0gOFYEk.mjs";
+import { n as resolveCodexAppServerRuntimeOptions } from "./config-runtime-BUH-IDVE.mjs";
 import { a as resolveCodexAppServerAuthProfileStore } from "./auth-profile-CgHQ8Vot.mjs";
 import { isDeepStrictEqual } from "node:util";
 import { listAgentIds, resolveAgentDir } from "openclaw/plugin-sdk/agent-scope-runtime";

package/dist/.setup/{app-server-policy-V8zuN8q_.mjs → app-server-policy-CF-JwGUD.mjs}

@@ -1,4 +1,4 @@
-import { n as canUseCodexModelBackedApprovalsReviewerForModel } from "./config-LQemoqTL.mjs";
+import { n as canUseCodexModelBackedApprovalsReviewerForModel } from "./config-d0gOFYEk.mjs";
 //#region extensions/codex/src/app-server/app-server-policy.ts
 function resolveCodexAppServerForModelProvider(params) {
 	return params.appServer.approvalsReviewer === "user" || canUseCodexModelBackedApprovalsReviewerForModel({

package/dist/.setup/{apply-BaBl0hiG.mjs → apply-DmhHTC5c.mjs}

@@ -1,13 +1,13 @@
-import { s as resolveCodexAppServerFallbackApiKeyCacheKey } from "./auth-cache-key-DrieYJUQ.mjs";
+import { s as resolveCodexAppServerFallbackApiKeyCacheKey } from "./auth-cache-key-KogLtj0t.mjs";
 import { a as defaultCodexAppInventoryCache, r as buildCodexPluginAppCacheKey } from "./plugin-app-cache-key-Bg9DbDI6.mjs";
-import { r as requestCodexAppServerJson } from "./request-XC1RG34l.mjs";
-import { r as isOpenAiCuratedMarketplaceName, u as CODEX_PLUGINS_MARKETPLACE_NAME } from "./plugin-inventory-OhiCoyPH.mjs";
-import "./config-LQemoqTL.mjs";
-import { n as resolveCodexAppServerRuntimeOptions } from "./config-runtime-DGB1-VbB.mjs";
+import { r as requestCodexAppServerJson } from "./request-ufWmJNN1.mjs";
+import { r as isOpenAiCuratedMarketplaceName, u as CODEX_PLUGINS_MARKETPLACE_NAME } from "./plugin-inventory-CZLnMaxf.mjs";
+import "./config-d0gOFYEk.mjs";
+import { n as resolveCodexAppServerRuntimeOptions } from "./config-runtime-BUH-IDVE.mjs";
 import { i as resolveCodexAppServerAuthProfileIdForAgent } from "./auth-profile-CgHQ8Vot.mjs";
-import { c as getLeasedSharedCodexAppServerClient, h as releaseLeasedSharedCodexAppServerClient, it as resolveCodexAppServerAuthAccountCacheKey, o as clearSharedCodexAppServerClientIfCurrentAndWait } from "./shared-client-AdQX0Tdq.mjs";
-import { t as ensureCodexPluginActivation } from "./plugin-activation-BgfNFH2L.mjs";
-import { CODEX_PLUGIN_CONFIG_PATH, buildCodexMigrationPlan, buildCodexPluginsConfigValue, hasCodexPluginConfigConflict, n as resolveCodexConfigPatchMode, readCodexPluginMigrationConfigEntry, t as createCodexAuthItemApplier } from "./plan-GqWF4XGA.mjs";
+import { c as getLeasedSharedCodexAppServerClient, h as releaseLeasedSharedCodexAppServerClient, it as resolveCodexAppServerAuthAccountCacheKey, o as clearSharedCodexAppServerClientIfCurrentAndWait } from "./shared-client-C0gEybHs.mjs";
+import { t as ensureCodexPluginActivation } from "./plugin-activation-Dbq2m2gh.mjs";
+import { CODEX_PLUGIN_CONFIG_PATH, buildCodexMigrationPlan, buildCodexPluginsConfigValue, hasCodexPluginConfigConflict, n as resolveCodexConfigPatchMode, readCodexPluginMigrationConfigEntry, t as createCodexAuthItemApplier } from "./plan-BE7gWwkn.mjs";
 import { uniqueStrings } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { parseStrictNonNegativeInteger } from "openclaw/plugin-sdk/number-runtime";
 import path from "node:path";

package/dist/.setup/{attempt-client-cleanup-jWVRH043.mjs → attempt-client-cleanup-DQBa7iiq.mjs}

@@ -1,9 +1,9 @@
-import { w as retireSharedCodexAppServerClientIfCurrent } from "./auth-cache-key-DrieYJUQ.mjs";
+import { I as isCodexAppServerBrokenPipeError, c as isCodexAppServerRequestTimeoutError } from "./client-CafYfF2n.mjs";
+import { w as retireSharedCodexAppServerClientIfCurrent } from "./auth-cache-key-KogLtj0t.mjs";
 import { a as codexPrewriteRejectionCause, o as isCodexAppServerOverloadError, r as CodexAppServerRpcError } from "./rpc-error-C98SHchT.mjs";
-import { X as unsubscribeCodexAppServerLiveThread, gt as isCodexAppServerStartupError, u as isCodexAppServerStartSelectionChangedError } from "./shared-client-AdQX0Tdq.mjs";
-import { I as isCodexAppServerBrokenPipeError, c as isCodexAppServerRequestTimeoutError } from "./client-BM97zH3z.mjs";
-import { n as getCodexAppServerTurnRouter } from "./turn-router-DnfbVPvu.mjs";
-import { t as __exportAll } from "./session-binding-sidecars-DijNZb31.mjs";
+import { X as unsubscribeCodexAppServerLiveThread, gt as isCodexAppServerStartupError, u as isCodexAppServerStartSelectionChangedError } from "./shared-client-C0gEybHs.mjs";
+import { n as getCodexAppServerTurnRouter } from "./turn-router-8CkGlezp.mjs";
+import { t as __exportAll } from "./session-binding-sidecars-CAHe3enw.mjs";
 import { createDeferred } from "openclaw/plugin-sdk/extension-shared";
 import { AgentHarnessPreflightError, embeddedAgentLog } from "openclaw/plugin-sdk/agent-harness-runtime";
 //#region extensions/codex/src/app-server/attempt-client-cleanup.ts

package/dist/.setup/{attempt-workspace-context-BkA0W8Jy.mjs → attempt-workspace-context-EAeScFrg.mjs}

@@ -1,5 +1,5 @@
 import { r as flattenCodexDynamicToolFunctions } from "./protocol-CANUwXJ3.mjs";
-import { I as isMessageOnlyCodexSourceReply } from "./thread-requests-DjyDmCo4.mjs";
+import { I as isMessageOnlyCodexSourceReply } from "./thread-requests-pX9_RXpU.mjs";
 import { normalizeLowercaseStringOrEmpty } from "openclaw/plugin-sdk/string-coerce-runtime";
 import path from "node:path";
 import { buildAgentWorkspaceInstructionSnapshot, buildBootstrapContextForFiles, embeddedAgentLog, prepareAgentWorkspaceContext } from "openclaw/plugin-sdk/agent-harness-runtime";

package/dist/.setup/{auth-binding-BFTkrP_b.mjs → auth-binding-D1TJwzWf.mjs}

@@ -1,5 +1,5 @@
 import { i as isCodexResponsesOAuthCredential, o as resolveCodexResponsesOAuthProfileFingerprint } from "./responses-oauth-twnuTaAa.mjs";
-import { t as __exportAll } from "./session-binding-sidecars-DijNZb31.mjs";
+import { t as __exportAll } from "./session-binding-sidecars-CAHe3enw.mjs";
 import { resolveApiKeyForProfile } from "openclaw/plugin-sdk/agent-runtime";
 import { fingerprintResolvedAuthProfileCredential } from "openclaw/plugin-sdk/agent-harness-runtime";
 import { resolveOpenAICodexAuthIdentity } from "openclaw/plugin-sdk/provider-auth";

package/dist/.setup/{auth-cache-key-DrieYJUQ.mjs → auth-cache-key-KogLtj0t.mjs}

@@ -1,6 +1,6 @@
-import { n as defineCodexBuildState } from "./build-state-B5mKL-in.mjs";
-import { u as resolveMacOSDesktopCodexAppPathCandidates } from "./managed-binary-DwC9wxch.mjs";
-import { n as resolveCodexAppServerSpawnEnv } from "./transport-stdio-lgeKKHyw.mjs";
+import { n as defineCodexBuildState } from "./build-state-CvGKuaeP.mjs";
+import { u as resolveMacOSDesktopCodexAppPathCandidates } from "./managed-binary-Boj8_lWV.mjs";
+import { n as resolveCodexAppServerSpawnEnv } from "./transport-stdio-BsXQmXll.mjs";
 import { isRecord, normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { createHash } from "node:crypto";
 import fs, { constants, existsSync, watch } from "node:fs";

package/dist/.setup/{binding-connection-C0t9TBX_.mjs → binding-connection-BIo1-hoT.mjs}

@@ -1,4 +1,4 @@
-import { t as __exportAll } from "./session-binding-sidecars-DijNZb31.mjs";
+import { t as __exportAll } from "./session-binding-sidecars-CAHe3enw.mjs";
 import { AgentHarnessPreflightError } from "openclaw/plugin-sdk/agent-harness-registration";
 import { createPluginRuntimeStore } from "openclaw/plugin-sdk/runtime-store";
 //#region extensions/codex/src/app-server/binding-connection.ts
@@ -44,7 +44,7 @@ function requireCodexSupervisionModelSelection(binding) {
 }
 /** Registration publishes the resolver; connection policy loads only for an actual request. */
 async function resolveCodexBindingAppServerConnection(params) {
-	return (await import("./binding-connection.runtime-Wdm5G_bw.mjs")).resolveCodexBindingAppServerConnection(params, catalogHomes.tryGetRuntime());
+	return (await import("./binding-connection.runtime-C5yDsKBQ.mjs")).resolveCodexBindingAppServerConnection(params, catalogHomes.tryGetRuntime());
 }
 //#endregion
 export { setCodexCatalogConnectionHomeResolver as a, resolveCodexBindingAppServerConnection as i, binding_connection_exports as n, requireCodexSupervisionModelSelection as r, assertCodexSessionRuntimeOwnership as t };

package/dist/.setup/{binding-connection.runtime-Wdm5G_bw.mjs → binding-connection.runtime-C5yDsKBQ.mjs}

@@ -1,7 +1,7 @@
 import { d as readCodexPluginConfig } from "./config-parsing-CVK2Q463.mjs";
 import { n as resolveCodexAppServerLocalHomeDir } from "./auth-start-options-BPIPeEX8.mjs";
 import { t as buildCodexAppServerConnectionFingerprint } from "./plugin-app-cache-key-Bg9DbDI6.mjs";
-import { n as resolveCodexAppServerRuntimeOptions, r as resolveCodexSupervisionAppServerRuntimeOptions } from "./config-runtime-DGB1-VbB.mjs";
+import { n as resolveCodexAppServerRuntimeOptions, r as resolveCodexSupervisionAppServerRuntimeOptions } from "./config-runtime-BUH-IDVE.mjs";
 //#region extensions/codex/src/app-server/binding-connection.runtime.ts
 /** Resolves connection and auth ownership exclusively from the private thread binding. */
 async function resolveCodexBindingAppServerConnection(params, discoverHomes) {

package/dist/.setup/{bounded-turn-s9yVsxaM.mjs → bounded-turn-B91suzbV.mjs}

@@ -1,18 +1,18 @@
+import { _ as assertCodexTurnStartResponse, b as readCodexErrorNotification, g as assertCodexThreadStartResponse, w as createCodexElicitationResponse } from "./client-CafYfF2n.mjs";
 import { i as isJsonObject } from "./protocol-CANUwXJ3.mjs";
 import { a as resolveCodexPrivateLauncher, i as readCodexAppServerConfigOptions } from "./launch-args-DbFCehO7.mjs";
 import { d as readCodexEffectiveConfig } from "./config-options-CZmH25Xq.mjs";
 import { a as codexPrewriteRejectionCause } from "./rpc-error-C98SHchT.mjs";
-import "./config-LQemoqTL.mjs";
-import { n as resolveCodexAppServerRuntimeOptions } from "./config-runtime-DGB1-VbB.mjs";
-import { u as isCodexAppServerStartSelectionChangedError } from "./shared-client-AdQX0Tdq.mjs";
-import { _ as assertCodexTurnStartResponse, b as readCodexErrorNotification, g as assertCodexThreadStartResponse, w as createCodexElicitationResponse } from "./client-BM97zH3z.mjs";
-import { o as closeCodexStartupClientBestEffort, s as interruptCodexTurnAndWaitBestEffort, t as CODEX_APP_SERVER_INTERRUPT_TIMEOUT_MS } from "./attempt-client-cleanup-jWVRH043.mjs";
-import { t as CodexEphemeralTurn } from "./ephemeral-turn-DeppK8zz.mjs";
-import { i as readModelListResult } from "./models-B65GHU4g.mjs";
-import { d as mergeCodexThreadConfigs } from "./project-doc-thread-config-D_sWbxFR.mjs";
+import "./config-d0gOFYEk.mjs";
+import { n as resolveCodexAppServerRuntimeOptions } from "./config-runtime-BUH-IDVE.mjs";
+import { u as isCodexAppServerStartSelectionChangedError } from "./shared-client-C0gEybHs.mjs";
+import { o as closeCodexStartupClientBestEffort, s as interruptCodexTurnAndWaitBestEffort, t as CODEX_APP_SERVER_INTERRUPT_TIMEOUT_MS } from "./attempt-client-cleanup-DQBa7iiq.mjs";
+import { t as CodexEphemeralTurn } from "./ephemeral-turn-CgKjGBaW.mjs";
+import { i as readModelListResult } from "./models-Dw0qUZl3.mjs";
+import { d as mergeCodexThreadConfigs } from "./project-doc-thread-config-BYFXSVGk.mjs";
 import { n as resolveCodexAppServerReasoningEffort } from "./reasoning-effort-CS9kKWB9.mjs";
-import { n as buildCodexRingZeroThreadConfigPatch, p as attestCodexRestrictedToolSurfaceMcpServersDisabled, r as buildCodexRuntimeThreadConfig, t as assertCodexManagedRequirementsDoNotOverrideToolPolicy, u as readCodexInheritedMcpServerNames } from "./thread-requests-DjyDmCo4.mjs";
-import { a as resolveCodexPromptError } from "./usage-limit-error-EoQ7Vl2A.mjs";
+import { n as buildCodexRingZeroThreadConfigPatch, p as attestCodexRestrictedToolSurfaceMcpServersDisabled, r as buildCodexRuntimeThreadConfig, t as assertCodexManagedRequirementsDoNotOverrideToolPolicy, u as readCodexInheritedMcpServerNames } from "./thread-requests-pX9_RXpU.mjs";
+import { a as resolveCodexPromptError } from "./usage-limit-error-DycN7mED.mjs";
 import { resolveTimerTimeoutMs } from "openclaw/plugin-sdk/number-runtime";
 import { parse } from "smol-toml";
 import path from "node:path";
@@ -147,7 +147,7 @@ async function runBoundedCodexAppServerTurnInWorkspace(params, appServer, worksp
 		assertCurrent: params.assertCurrent,
 		...params.signal ? { abandonSignal: params.signal } : {}
 	};
-	const client = params.options.clientFactory ? await params.options.clientFactory(clientOptions) : await import("./shared-client-AdQX0Tdq.mjs").then((n) => n.v).then(({ createIsolatedCodexAppServerClient }) => createIsolatedCodexAppServerClient({
+	const client = params.options.clientFactory ? await params.options.clientFactory(clientOptions) : await import("./shared-client-C0gEybHs.mjs").then((n) => n.v).then(({ createIsolatedCodexAppServerClient }) => createIsolatedCodexAppServerClient({
 		...clientOptions,
 		authProfileStore: params.authProfileStore
 	}));

package/dist/.setup/{bounded-turn-isolation-CIQJykuM.mjs → bounded-turn-isolation-BRNgfoRl.mjs}

@@ -1,8 +1,8 @@
 import { d as readCodexPluginConfig } from "./config-parsing-CVK2Q463.mjs";
 import { n as isCodexAppServerProxyLaunch } from "./launch-args-DbFCehO7.mjs";
 import { i as resolveCodexAppServerHomeScope } from "./config-options-CZmH25Xq.mjs";
-import "./config-LQemoqTL.mjs";
-import { n as resolveCodexAppServerRuntimeOptions } from "./config-runtime-DGB1-VbB.mjs";
+import "./config-d0gOFYEk.mjs";
+import { n as resolveCodexAppServerRuntimeOptions } from "./config-runtime-BUH-IDVE.mjs";
 //#region extensions/codex/src/app-server/bounded-turn-isolation.ts
 function resolveCodexBoundedTurnIsolation(options) {
 	const pluginConfig = readCodexPluginConfig(options.pluginConfig);

package/dist/.setup/{build-state-B5mKL-in.mjs → build-state-CvGKuaeP.mjs}

@@ -1,5 +1,5 @@
 //#region extensions/codex/package.json
-var version = "2026.10.7";
+var version = "2026.10.9";
 //#endregion
 //#region extensions/codex/src/build-state.ts
 /**

package/dist/.setup/{client-BM97zH3z.mjs → client-CafYfF2n.mjs}

@@ -1,16 +1,16 @@
-import { a as readCodexCatalogDecodeRoute, c as isRpcResponse, i as listenCodexAppServerLines, n as projectCodexCatalogMessage, o as CodexAppServerMessageDecoder, r as createCodexAppServerMessageWriter, s as redactCodexAppServerLinePreview } from "./client-catalog-response-DhB266B_.mjs";
 import { i as isJsonObject } from "./protocol-CANUwXJ3.mjs";
-import { c as MIN_SUPPORTED_CODEX_APP_SERVER_VERSION, s as CODEX_APP_SERVER_VERSION } from "./managed-binary-DwC9wxch.mjs";
-import { a as closeCodexAppServerTransportAndWait, c as getCodexAppServerRegisteredTransportIdentity, i as closeCodexAppServerTransport, o as hasCodexAppServerNaturalExit, t as createStdioTransport } from "./transport-stdio-lgeKKHyw.mjs";
+import { c as MIN_SUPPORTED_CODEX_APP_SERVER_VERSION, s as CODEX_APP_SERVER_VERSION } from "./managed-binary-Boj8_lWV.mjs";
+import { a as closeCodexAppServerTransportAndWait, c as getCodexAppServerRegisteredTransportIdentity, i as closeCodexAppServerTransport, o as hasCodexAppServerNaturalExit, t as createStdioTransport } from "./transport-stdio-BsXQmXll.mjs";
 import { i as CodexAppServerScopedRequestRejectedError, n as CodexAppServerLocalRequestCancellationError, o as isCodexAppServerOverloadError, r as CodexAppServerRpcError, t as CODEX_APP_SERVER_OVERLOADED_ERROR_CODE } from "./rpc-error-C98SHchT.mjs";
-import { n as codexCatalogSourceForClient, s as recordCodexCatalogResponseSource, t as closeCodexCatalogClientSource } from "./session-catalog-source-CfIBVrbT.mjs";
-import { i as reuseCodexCatalogPreview } from "./session-catalog-native-projection-BYV0ICja.mjs";
-import { n as resolveCodexAppServerRuntimeOptions } from "./config-runtime-DGB1-VbB.mjs";
+import { n as codexCatalogSourceForClient, s as recordCodexCatalogResponseSource, t as closeCodexCatalogClientSource } from "./session-catalog-source-qHe5r9i_.mjs";
+import { i as reuseCodexCatalogPreview, n as projectCodexCatalogNativeResponse, r as projectCodexCatalogNativeThread } from "./session-catalog-native-projection-CHtG8DwY.mjs";
+import { n as resolveCodexAppServerRuntimeOptions } from "./config-runtime-BUH-IDVE.mjs";
 import { codexCatalogPageWorkerEntrypoint } from "../catalog-page-worker-entrypoint.js";
-import { t as createWebSocketTransport } from "./transport-websocket-CEBjEtFP.mjs";
-import { t as __exportAll } from "./session-binding-sidecars-DijNZb31.mjs";
+import { t as createWebSocketTransport } from "./transport-websocket-B5mq2Iq2.mjs";
+import { t as __exportAll } from "./session-binding-sidecars-CAHe3enw.mjs";
 import { isRecord, normalizeOptionalString, readStringField } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { randomUUID } from "node:crypto";
+import { embeddedAgentLog } from "openclaw/plugin-sdk/agent-harness-registration";
 import { normalizeJsonSchemaForTypeBox } from "openclaw/plugin-sdk/json-schema-runtime";
 import { addSafeTimeoutDelayGraceMs, addTimerTimeoutGraceMs, parseStrictNonNegativeInteger } from "openclaw/plugin-sdk/number-runtime";
 import { sliceUtf16Safe, truncateUtf16Safe } from "openclaw/plugin-sdk/text-utility-runtime";
@@ -18,12 +18,299 @@ import path from "node:path";
 import { coerceErrorMessage, toStringifiedError } from "openclaw/plugin-sdk/error-runtime";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createDeferred } from "openclaw/plugin-sdk/extension-shared";
-import { OPENCLAW_VERSION, embeddedAgentLog, formatToolExecutionErrorMessage, normalizeQuestionTimeoutSeconds, resolveToolExecutionErrorKind } from "openclaw/plugin-sdk/agent-harness-runtime";
+import { OPENCLAW_VERSION as OPENCLAW_VERSION$1, embeddedAgentLog as embeddedAgentLog$1, formatToolExecutionErrorMessage, normalizeQuestionTimeoutSeconds, resolveToolExecutionErrorKind } from "openclaw/plugin-sdk/agent-harness-runtime";
 import { sleepWithAbort } from "openclaw/plugin-sdk/runtime-env";
+import { sanitizeTerminalText } from "openclaw/plugin-sdk/text-chunking";
 import { parse } from "semver";
 import { AsyncWorkScope } from "openclaw/plugin-sdk/concurrency-runtime";
 import { copyInternalToolResultState, runWithAsyncWorkResources } from "openclaw/plugin-sdk/agent-harness-tool-runtime";
 import { Compile } from "typebox/compile";
+//#region extensions/codex/src/app-server/protocol-json.ts
+function isRpcResponse(message) {
+	return message !== null && typeof message === "object" && "id" in message && (typeof message.id === "number" || typeof message.id === "string") && !("method" in message);
+}
+//#endregion
+//#region extensions/codex/src/app-server/client-line-preview.ts
+const CODEX_APP_SERVER_PARSE_LOG_MAX = 500;
+function redactCodexAppServerLinePreview(value) {
+	const redacted = value.replace(/\s+/g, " ").trim().replace(/(Bearer\s+)[A-Za-z0-9._~+/-]+/gi, "$1<redacted>").replace(/("(?:api_?key|authorization|token|access_token|refresh_token)"\s*:\s*")([^"]+)(")/gi, "$1<redacted>$3").replace(/\b([a-z0-9_]*(?:api_?key|authorization|access_token|refresh_token|token))(\s*=\s*)(["']?)[^\s"']+(\3)/gi, "$1$2$3<redacted>$4");
+	return redacted.length > CODEX_APP_SERVER_PARSE_LOG_MAX ? `${truncateUtf16Safe(redacted, CODEX_APP_SERVER_PARSE_LOG_MAX)}...` : redacted;
+}
+//#endregion
+//#region extensions/codex/src/app-server/client-message-decoder.ts
+const PARSE_BUFFER_MAX = 8388608;
+const PARSE_BUFFER_MAX_LINES = 1e3;
+const UNICODE_ESCAPE_QUAD = /^[\da-fA-F]{4}$/u;
+/** Recovers the raw newlines observed inside native JSON string values. */
+var CodexAppServerMessageDecoder = class {
+	constructor(reportError) {
+		this.reportError = reportError;
+	}
+	clear() {
+		this.pending = void 0;
+	}
+	get hasPending() {
+		return this.pending !== void 0;
+	}
+	parse(line) {
+		const rawLine = line.endsWith("\r") ? line.slice(0, -1) : line;
+		const pending = this.pending;
+		let candidate;
+		let withinBounds = true;
+		if (pending) {
+			pending.fragments.push(rawLine);
+			pending.length += 2 + rawLine.length;
+			withinBounds = pending.length <= PARSE_BUFFER_MAX && pending.fragments.length <= PARSE_BUFFER_MAX_LINES;
+			if (withinBounds && pending.inString && scanJsonString(rawLine, 0) === rawLine.length) return;
+			candidate = pending.fragments.join("\\n");
+			this.pending = void 0;
+		} else {
+			candidate = rawLine.trim();
+			if (!candidate) return;
+		}
+		try {
+			return JSON.parse(candidate);
+		} catch (error) {
+			const text = pending ? candidate : rawLine.trimStart();
+			const inString = withinBounds ? recoverableJsonStringState(text, error) : void 0;
+			if (inString !== void 0) {
+				if (pending) pending.inString = inString;
+				this.pending = pending ?? {
+					fragments: [text],
+					length: text.length,
+					inString
+				};
+			} else this.reportError(candidate, error, pending?.fragments.length ?? 1);
+		}
+	}
+};
+/** Undefined rejects malformed JSON; false retains a trailing escape for native parsing. */
+function recoverableJsonStringState(value, error) {
+	if (!(error instanceof SyntaxError) || !value.startsWith("{") && !value.startsWith("[")) return;
+	const closers = [];
+	for (let index = 0; index < value.length; index++) {
+		const character = value[index];
+		if (character === "{" || character === "[") closers.push(character === "{" ? "}" : "]");
+		else if (character === "}" || character === "]") closers.pop();
+		if (character !== "\"") continue;
+		const end = scanJsonString(value, index + 1);
+		if (end < 0) return;
+		if (end >= value.length) {
+			const closing = closers.toReversed().join("");
+			for (const suffix of ["\"", "\":null"]) try {
+				JSON.parse(`${value}\\n${suffix}${closing}`);
+				return end === value.length;
+			} catch {}
+			return;
+		}
+		index = end;
+	}
+}
+/** Finds a closing quote; incomplete or invalid escapes require native parsing. */
+function scanJsonString(value, start) {
+	for (let index = start; index < value.length; index++) {
+		const character = value[index];
+		if (character === "\"") return index;
+		if (value.charCodeAt(index) < 32) return -1;
+		if (character !== "\\") continue;
+		const escape = value[++index];
+		if (!escape) return value.length + 1;
+		else if (escape === "u") {
+			if (!UNICODE_ESCAPE_QUAD.test(value.slice(index + 1, index + 5))) return -1;
+			index += 4;
+		} else if (!"\"\\/bfnrt".includes(escape)) return -1;
+	}
+	return value.length;
+}
+//#endregion
+//#region extensions/codex/src/app-server/client-message-frames.ts
+function createCodexAppServerMessageWriter(options) {
+	return (message, onError, beforeWrite, onWriteResult) => {
+		if (options.isClosed()) return;
+		const child = options.getTransport();
+		const id = "id" in message ? message.id : void 0;
+		const method = "method" in message ? message.method : void 0;
+		const frame = JSON.stringify(message, (_key, value) => typeof value === "string" ? value.replace(UNPAIRED_SURROGATE_RE, "") : value) ?? "null";
+		if (child.maxFrameBytes && Buffer.byteLength(frame) > child.maxFrameBytes) throw new Error("Codex request exceeds the transport frame limit; reduce attached images or context.");
+		beforeWrite?.();
+		if (method === "command/exec") options.onNativeExecution();
+		child.stdin.write(`${frame}\n`, (error) => {
+			onWriteResult?.(error);
+			if (error) {
+				embeddedAgentLog.warn("codex app-server write failed", {
+					error,
+					id,
+					method
+				});
+				onError?.(error);
+			}
+		});
+	};
+}
+const UNPAIRED_SURROGATE_RE = /[\uD800-\uDBFF](?![\uDC00-\uDFFF])|(?<![\uD800-\uDBFF])[\uDC00-\uDFFF]/g;
+/** One byte reader owns framing and stops at an asynchronous page decode. */
+function listenCodexAppServerLines(input, onLine, onError) {
+	let fragments = [];
+	let length = 0;
+	let remainder;
+	let waiting = false;
+	let ended = false;
+	let closed = false;
+	const close = () => {
+		closed = true;
+		fragments = [];
+		remainder = void 0;
+		input.off("data", onData);
+		input.off("end", onEnd);
+		input.pause();
+	};
+	const deliver = (tail) => {
+		const line = fragments.length ? Buffer.concat([...fragments, tail], length + tail.length) : tail;
+		fragments = [];
+		length = 0;
+		const completion = onLine(line);
+		if (!completion) return true;
+		waiting = true;
+		input.pause();
+		completion.then(() => {
+			waiting = false;
+			if (!closed) {
+				drain();
+				if (!waiting && !ended && !closed) input.resume();
+			}
+		}).catch((error) => {
+			close();
+			onError(error);
+		});
+		return false;
+	};
+	const drain = () => {
+		try {
+			const chunk = remainder;
+			remainder = void 0;
+			if (chunk) {
+				let start = 0;
+				let end;
+				while ((end = chunk.indexOf(10, start)) !== -1) {
+					if (closed) return;
+					remainder = chunk.subarray(end + 1);
+					if (!deliver(chunk.subarray(start, end))) return;
+					remainder = void 0;
+					start = end + 1;
+				}
+				if (!closed && start < chunk.length) {
+					fragments.push(chunk.subarray(start));
+					length += chunk.length - start;
+				}
+			}
+			if (ended && !closed) {
+				if (length && !deliver(Buffer.alloc(0))) return;
+				close();
+			}
+		} catch (error) {
+			close();
+			onError(error);
+		}
+	};
+	const onData = (chunk) => {
+		remainder = chunk;
+		drain();
+	};
+	const onEnd = () => {
+		ended = true;
+		if (!waiting) drain();
+	};
+	input.on("data", onData);
+	input.once("end", onEnd);
+	return close;
+}
+function codexCatalogResponseRoute(id) {
+	return typeof id === "number" && Number.isSafeInteger(id) && id >= 2 ** 52 ? {
+		id,
+		kind: id % 2 === 1 ? "list" : "thread"
+	} : void 0;
+}
+/** Read bounded envelope keys and IDs; skip native payload strings as bytes. */
+function readCodexCatalogDecodeRoute(line) {
+	let depth = 0;
+	let route;
+	let response = false;
+	for (let index = 0; index < line.length; index++) {
+		const byte = line[index];
+		if (byte === 123 || byte === 91) depth++;
+		else if (byte === 125 || byte === 93) depth--;
+		else if (byte === 34) {
+			const start = index;
+			for (;;) {
+				index = line.indexOf(34, index + 1);
+				if (index < 0) return "unresolved";
+				let slash = index - 1;
+				while (line[slash] === 92) slash--;
+				if ((index - slash) % 2 === 1) break;
+			}
+			if (depth !== 1 || index - start > 64) continue;
+			let colon = index + 1;
+			while (line[colon] === 32 || line[colon] === 9 || line[colon] === 13) colon++;
+			if (line[colon] !== 58) continue;
+			const token = line.toString("utf8", start, index + 1);
+			let key = token.slice(1, -1);
+			if (token.includes("\\")) try {
+				key = JSON.parse(token);
+			} catch {
+				return "unresolved";
+			}
+			if (key === "method") return;
+			if (key === "result" || key === "error") {
+				response = true;
+				if (route) return route;
+			}
+			if (key !== "id") continue;
+			const match = /^\s*:\s*(\d+)(?=\s*[,}])/u.exec(line.toString("utf8", index + 1, Math.min(index + 100, line.length)));
+			if (!match) continue;
+			route = codexCatalogResponseRoute(Number(match[1]));
+			if (!route || response) return route;
+		}
+	}
+	return response || route ? "unresolved" : void 0;
+}
+//#endregion
+//#region extensions/codex/src/app-server/client-catalog-response.ts
+function projectCodexCatalogMessage(parsed, input, cachedPreview) {
+	const result = {
+		pending: false,
+		failures: []
+	};
+	if (!isJsonObject(parsed)) return result;
+	result.message = parsed;
+	if (!isRpcResponse(parsed)) return result;
+	const message = parsed;
+	const route = codexCatalogResponseRoute(message.id);
+	if (message.error || !route) return result;
+	const remainingRows = input.route === "unresolved" ? input.catalogRows?.has(route.id) ? input.catalogRows.get(route.id) : 0 : input.remainingRows;
+	try {
+		if (!isJsonObject(message.result)) throw new Error("Codex catalog response contains an invalid result");
+		if (route.kind === "list") {
+			const raw = message.result;
+			message.result = projectCodexCatalogNativeResponse(raw, sanitizeTerminalText, cachedPreview, remainingRows);
+			if (!cachedPreview) result.previewStates = Array.isArray(raw.data) ? raw.data.slice(0, Array.isArray(message.result.data) ? message.result.data.length : 0).map((row) => isJsonObject(row) && typeof row.preview === "string" ? Boolean(row.preview) : void 0) : [];
+		} else {
+			const thread = message.result.thread;
+			message.result = { thread: {
+				...projectCodexCatalogNativeThread(thread, sanitizeTerminalText),
+				...isJsonObject(thread) && typeof thread.cwd === "string" ? { cwd: thread.cwd } : {},
+				...isJsonObject(thread) && (thread.historyMode === "paginated" || thread.historyMode === "legacy") ? { historyMode: thread.historyMode } : {}
+			} };
+		}
+	} catch (error) {
+		delete result.message;
+		result.projectionError = {
+			id: route.id,
+			error: error instanceof Error ? error : new Error("Codex catalog projection failed", { cause: error })
+		};
+	}
+	return result;
+}
+//#endregion
 //#region extensions/codex/src/app-server/client-catalog-worker.ts
 const INLINE_CATALOG_MAX_BYTES = 65536;
 const CATALOG_WORKER_IDLE_MS = 6e4;
@@ -139,9 +426,9 @@ function observeCodexAppServerStderr(stderr, consume) {
 	stderr.setEncoding("utf8");
 	stderr.on("data", (chunk) => {
 		const text = consume(chunk).trim();
-		if (text) embeddedAgentLog.debug(`codex app-server stderr: ${text}`);
+		if (text) embeddedAgentLog$1.debug(`codex app-server stderr: ${text}`);
 	});
-	stderr.on("error", (error) => embeddedAgentLog.warn("codex app-server stderr stream failed", { error }));
+	stderr.on("error", (error) => embeddedAgentLog$1.warn("codex app-server stderr stream failed", { error }));
 }
 function appendBoundedTail(current, next, maxLength) {
 	const combined = `${current}${next}`;
@@ -155,7 +442,7 @@ function buildCodexAppServerExitError(code, signal, stderrTail) {
 function logCodexAppServerParseFailure(value, error, fragmentCount) {
 	const linePreview = redactCodexAppServerLinePreview(value);
 	const suffix = fragmentCount > 1 ? ` fragments=${fragmentCount}` : "";
-	embeddedAgentLog.warn("failed to parse codex app-server message", {
+	embeddedAgentLog$1.warn("failed to parse codex app-server message", {
 		error,
 		errorMessage: coerceErrorMessage(error),
 		fragmentCount,
@@ -285,7 +572,7 @@ function buildCodexAppServerInitializeParams() {
 		clientInfo: {
 			name: "openclaw",
 			title: "OpenClaw",
-			version: OPENCLAW_VERSION
+			version: OPENCLAW_VERSION$1
 		},
 		capabilities: {
 			experimentalApi: true,
@@ -325,7 +612,7 @@ function assertSupportedCodexAppServerVersion(response) {
 	if (!detectedVersion) throw new CodexAppServerVersionError(detectedVersion);
 	const detected = parse(detectedVersion);
 	if (!detected || detected.compare("0.149.0") < 0) throw new CodexAppServerVersionError(detectedVersion);
-	if (detected.compare("0.160.0") > 0) embeddedAgentLog.warn("codex app-server is newer than OpenClaw's managed runtime; continuing with normal startup validation", {
+	if (detected.compare("0.160.0") > 0) embeddedAgentLog$1.warn("codex app-server is newer than OpenClaw's managed runtime; continuing with normal startup validation", {
 		detectedVersion,
 		validatedVersion: CODEX_APP_SERVER_VERSION
 	});
@@ -350,7 +637,7 @@ function logCodexAppServerManagedWarning(notification) {
 	const message = readCodexAppServerWarningMessage(notification.params);
 	if (!(notification.method === "warning" && notification.params.threadId === null && CODEX_LOG_WRITE_WARNINGS.has(message)) && !LOG_ONLY_CODEX_WARNING_PATTERNS.some((pattern) => pattern.test(message))) return false;
 	try {
-		embeddedAgentLog.warn(message);
+		embeddedAgentLog$1.warn(message);
 	} catch {}
 	return true;
 }
@@ -373,10 +660,10 @@ var CodexAppServerNotifications = class {
 		}
 		for (const handler of this.handlers) try {
 			Promise.resolve(handler(notification)).catch((error) => {
-				embeddedAgentLog.warn("codex app-server notification handler failed", { error });
+				embeddedAgentLog$1.warn("codex app-server notification handler failed", { error });
 			});
 		} catch (error) {
-			embeddedAgentLog.warn("codex app-server notification handler failed", { error });
+			embeddedAgentLog$1.warn("codex app-server notification handler failed", { error });
 		}
 	}
 };
@@ -756,7 +1043,7 @@ async function handleDynamicToolCallWithTimeout(params) {
 				params.onAgentToolResult?.(event);
 			} catch (error) {
 				const message = formatToolExecutionErrorMessage(error, "Unknown error");
-				embeddedAgentLog.warn(`onAgentToolResult handler failed: tool=${params.call.tool} error=${message}`);
+				embeddedAgentLog$1.warn(`onAgentToolResult handler failed: tool=${params.call.tool} error=${message}`);
 			}
 		};
 		const notifyFailedToolResult = (message, terminalReason = "failed") => {
@@ -816,7 +1103,7 @@ async function handleDynamicToolCallWithTimeout(params) {
 				params.onFallbackSelected?.();
 				controller.abort(new Error(timeoutDetails.responseMessage));
 				params.onTimeout?.();
-				embeddedAgentLog.warn("codex dynamic tool call timed out", {
+				embeddedAgentLog$1.warn("codex dynamic tool call timed out", {
 					...timeoutDetails.meta,
 					consoleMessage: timeoutDetails.consoleMessage
 				});
@@ -3626,7 +3913,7 @@ var CodexServerRequests = class {
 		const armTimeout = () => {
 			clearTimeout(timeout);
 			timeout = setTimeout(() => {
-				embeddedAgentLog.warn("codex app-server server request timed out", {
+				embeddedAgentLog$1.warn("codex app-server server request timed out", {
 					id: request.id,
 					method: request.method,
 					timeoutMs
@@ -3660,7 +3947,7 @@ var CodexServerRequests = class {
 			});
 		} catch (error) {
 			if (this.active.get(request.id) === entry) {
-				embeddedAgentLog.warn("codex app-server server request handler failed", {
+				embeddedAgentLog$1.warn("codex app-server server request handler failed", {
 					id: request.id,
 					method: request.method,
 					error
@@ -4076,7 +4363,7 @@ var CodexAppServerClient = class CodexAppServerClient {
 		try {
 			await this.closeAndWait();
 		} catch (closeError) {
-			embeddedAgentLog.warn("codex app-server shutdown after indeterminate request failed", {
+			embeddedAgentLog$1.warn("codex app-server shutdown after indeterminate request failed", {
 				closeError,
 				operation
 			});
@@ -4145,7 +4432,7 @@ var CodexAppServerClient = class CodexAppServerClient {
 		this.decoder.clear();
 		this.catalogWorkerClosed = this.catalogWorker.close(error);
 		this.catalogWorkerClosed?.catch((closeError) => {
-			embeddedAgentLog.warn("codex catalog worker shutdown failed", { error: closeError });
+			embeddedAgentLog$1.warn("codex catalog worker shutdown failed", { error: closeError });
 		});
 		this.serverRequestsClosed = this.serverRequests.close(error);
 		for (const pending of this.pending.values()) pending.close(error);
@@ -4153,7 +4440,7 @@ var CodexAppServerClient = class CodexAppServerClient {
 		for (const handler of this.closeHandlers) try {
 			handler(this);
 		} catch (closeError) {
-			embeddedAgentLog.warn("codex app-server close handler failed", { error: closeError });
+			embeddedAgentLog$1.warn("codex app-server close handler failed", { error: closeError });
 		}
 		return true;
 	}

package/dist/.setup/{command-dispatch-DsaWfzET.mjs → command-dispatch-C2tNChTq.mjs}

@@ -8,7 +8,7 @@ async function handleCodexCommand(ctx, options) {
 	};
 	const { resolvePluginConfig, ...subcommandOptions } = options;
 	try {
-		const { handleCodexSubcommand } = await import("./command-handlers-zgDE_J40.mjs");
+		const { handleCodexSubcommand } = await import("./command-handlers-yb5vwwrx.mjs");
 		return await handleCodexSubcommand(commandContext, {
 			...subcommandOptions,
 			pluginConfig: resolvePluginConfig?.() ?? subcommandOptions.pluginConfig