@openclaw/codex 2026.5.16-beta.2 → 2026.5.16-beta.4

package/dist/{client-CA7amCZ8.js → client-6FkrXfaz.js}

@@ -1,4 +1,4 @@
-import { c as resolveCodexAppServerRuntimeOptions } from "./config-3ATInASk.js";
+import { c as resolveCodexAppServerRuntimeOptions } from "./config-B5pq6hEz.js";
 import { n as isRpcResponse } from "./protocol-C9UWI98H.js";
 import { createInterface } from "node:readline";
 import { OPENCLAW_VERSION, embeddedAgentLog } from "openclaw/plugin-sdk/agent-harness-runtime";

package/dist/{client-factory-DwzPofwS.js → client-factory-9L6Ie1dC.js}

@@ -1,5 +1,5 @@
 //#region extensions/codex/src/app-server/client-factory.ts
-const defaultCodexAppServerClientFactory = (startOptions, authProfileId, agentDir, config) => import("./shared-client-CnbrvEfV.js").then((n) => n.a).then(({ getSharedCodexAppServerClient }) => getSharedCodexAppServerClient({
+const defaultCodexAppServerClientFactory = (startOptions, authProfileId, agentDir, config) => import("./shared-client-DlvmoLBJ.js").then((n) => n.a).then(({ getSharedCodexAppServerClient }) => getSharedCodexAppServerClient({
 	startOptions,
 	authProfileId,
 	agentDir,

package/dist/{command-handlers-D6UDzndR.js → command-handlers-jZV_1Ks9.js}

@@ -1,11 +1,11 @@
-import { a as isCodexFastServiceTier, c as resolveCodexAppServerRuntimeOptions } from "./config-3ATInASk.js";
-import { n as listCodexAppServerModels, t as listAllCodexAppServerModels } from "./models-BHS-8DS_.js";
+import { a as isCodexFastServiceTier, c as resolveCodexAppServerRuntimeOptions } from "./config-B5pq6hEz.js";
+import { n as listCodexAppServerModels, t as listAllCodexAppServerModels } from "./models-C1zn2RN0.js";
 import { t as isJsonObject } from "./protocol-C9UWI98H.js";
-import { i as describeControlFailure, r as CODEX_CONTROL_METHODS, t as requestCodexAppServerJson } from "./request-Czoa60Nt.js";
+import { i as describeControlFailure, r as CODEX_CONTROL_METHODS, t as requestCodexAppServerJson } from "./request-XPjLayGw.js";
 import { a as formatComputerUseStatus, c as formatThreads, i as formatCodexStatus, l as readString$1, n as formatAccount, o as formatList, p as summarizeCodexAccountUsage, r as formatCodexDisplayText, s as formatModels, t as buildHelp } from "./command-formatters-BRW7_Nu7.js";
-import { i as readCodexAppServerBinding, o as writeCodexAppServerBinding, t as clearCodexAppServerBinding } from "./session-binding-DbdVqMzW.js";
-import { _ as steerCodexConversationTurn, b as readCodexConversationBindingData, d as parseCodexFastModeArg, f as parseCodexPermissionsModeArg, g as setCodexConversationPermissions, h as setCodexConversationModel, l as startCodexConversationThread, m as setCodexConversationFastMode, p as readCodexConversationActiveTurn, r as formatCodexCliSessions, u as formatPermissionsMode, v as stopCodexConversationTurn, x as resolveCodexDefaultWorkspaceDir, y as createCodexCliNodeConversationBindingData } from "./node-cli-sessions-BLDFnUEF.js";
-import { n as installCodexComputerUse, r as readCodexComputerUseStatus } from "./computer-use-BX02ojP4.js";
+import { i as readCodexAppServerBinding, o as writeCodexAppServerBinding, t as clearCodexAppServerBinding } from "./session-binding-DqApZIgD.js";
+import { _ as steerCodexConversationTurn, b as readCodexConversationBindingData, d as parseCodexFastModeArg, f as parseCodexPermissionsModeArg, g as setCodexConversationPermissions, h as setCodexConversationModel, l as startCodexConversationThread, m as setCodexConversationFastMode, p as readCodexConversationActiveTurn, r as formatCodexCliSessions, u as formatPermissionsMode, v as stopCodexConversationTurn, x as resolveCodexDefaultWorkspaceDir, y as createCodexCliNodeConversationBindingData } from "./node-cli-sessions-BKhlcAB9.js";
+import { n as installCodexComputerUse, r as readCodexComputerUseStatus } from "./computer-use-UJ3dxrXF.js";
 import { n as rememberCodexRateLimits } from "./rate-limit-cache-dvhq-4pi.js";
 import crypto from "node:crypto";
 import { ensureAuthProfileStore, findNormalizedProviderValue, resolveAuthProfileEligibility, resolveAuthProfileOrder, resolveDefaultAgentDir, resolveProfileUnusableUntilForDisplay } from "openclaw/plugin-sdk/agent-runtime";

package/dist/{compact-96QPqIAu.js → compact-UKyG6Pw2.js}

@@ -1,7 +1,7 @@
-import { c as resolveCodexAppServerRuntimeOptions } from "./config-3ATInASk.js";
+import { c as resolveCodexAppServerRuntimeOptions } from "./config-B5pq6hEz.js";
 import { t as isJsonObject } from "./protocol-C9UWI98H.js";
-import { i as readCodexAppServerBinding, t as clearCodexAppServerBinding } from "./session-binding-DbdVqMzW.js";
-import { t as defaultCodexAppServerClientFactory } from "./client-factory-DwzPofwS.js";
+import { i as readCodexAppServerBinding, t as clearCodexAppServerBinding } from "./session-binding-DqApZIgD.js";
+import { t as defaultCodexAppServerClientFactory } from "./client-factory-9L6Ie1dC.js";
 import { embeddedAgentLog, formatErrorMessage, isActiveHarnessContextEngine, resolveContextEngineOwnerPluginId, runHarnessContextEngineMaintenance } from "openclaw/plugin-sdk/agent-harness-runtime";
 //#region extensions/codex/src/app-server/compact.ts
 const DEFAULT_CODEX_COMPACTION_WAIT_TIMEOUT_MS = 300 * 1e3;

package/dist/{computer-use-BX02ojP4.js → computer-use-UJ3dxrXF.js}

@@ -1,5 +1,5 @@
-import { c as resolveCodexAppServerRuntimeOptions, l as resolveCodexComputerUseConfig } from "./config-3ATInASk.js";
-import { i as describeControlFailure, t as requestCodexAppServerJson } from "./request-Czoa60Nt.js";
+import { c as resolveCodexAppServerRuntimeOptions, l as resolveCodexComputerUseConfig } from "./config-B5pq6hEz.js";
+import { i as describeControlFailure, t as requestCodexAppServerJson } from "./request-XPjLayGw.js";
 import { existsSync } from "node:fs";
 //#region extensions/codex/src/app-server/computer-use.ts
 var CodexComputerUseSetupError = class extends Error {

package/dist/{config-3ATInASk.js → config-B5pq6hEz.js}

@@ -3,7 +3,8 @@ import { readFileSync } from "node:fs";
 import { hostname } from "node:os";
 import { z } from "zod";
 //#region extensions/codex/src/app-server/config.ts
-const START_OPTIONS_KEY_SECRET = randomBytes(32);
+const START_OPTIONS_KEY_SECRET_SYMBOL = Symbol.for("openclaw.codexAppServerStartOptionsKeySecret");
+const START_OPTIONS_KEY_SECRET = getStartOptionsKeySecret();
 const UNIX_CODEX_REQUIREMENTS_PATH = "/etc/codex/requirements.toml";
 const WINDOWS_CODEX_REQUIREMENTS_SUFFIX = "\\OpenAI\\Codex\\requirements.toml";
 const CODEX_PLUGINS_MARKETPLACE_NAME = "openai-curated";
@@ -472,6 +473,11 @@ function hashSecretForKey(value, label) {
 	if (!value) return null;
 	return createHmac("sha256", START_OPTIONS_KEY_SECRET).update(label).update("\0").update(value).digest("hex");
 }
+function getStartOptionsKeySecret() {
+	const globalState = globalThis;
+	globalState[START_OPTIONS_KEY_SECRET_SYMBOL] ??= randomBytes(32);
+	return globalState[START_OPTIONS_KEY_SECRET_SYMBOL];
+}
 function splitShellWords(value) {
 	const words = [];
 	let current = "";

package/dist/harness.js

@@ -18,28 +18,28 @@ function createCodexAppServerAgentHarness(options) {
 			};
 		},
 		runAttempt: async (params) => {
-			const { runCodexAppServerAttempt } = await import("./run-attempt-B6gN6CrO.js");
+			const { runCodexAppServerAttempt } = await import("./run-attempt-DMKAwtUV.js");
 			return runCodexAppServerAttempt(params, {
 				pluginConfig: options?.pluginConfig,
 				nativeHookRelay: { enabled: true }
 			});
 		},
 		runSideQuestion: async (params) => {
-			const { runCodexAppServerSideQuestion } = await import("./side-question-CFcVH8fj.js");
+			const { runCodexAppServerSideQuestion } = await import("./side-question-BYYJZq23.js");
 			return runCodexAppServerSideQuestion(params, { pluginConfig: options?.pluginConfig });
 		},
 		compact: async (params) => {
-			const { maybeCompactCodexAppServerSession } = await import("./compact-96QPqIAu.js");
+			const { maybeCompactCodexAppServerSession } = await import("./compact-UKyG6Pw2.js");
 			return maybeCompactCodexAppServerSession(params, { pluginConfig: options?.pluginConfig });
 		},
 		reset: async (params) => {
 			if (params.sessionFile) {
-				const { clearCodexAppServerBinding } = await import("./session-binding-DbdVqMzW.js").then((n) => n.a);
+				const { clearCodexAppServerBinding } = await import("./session-binding-DqApZIgD.js").then((n) => n.a);
 				await clearCodexAppServerBinding(params.sessionFile);
 			}
 		},
 		dispose: async () => {
-			const { clearSharedCodexAppServerClientAndWait } = await import("./shared-client-CnbrvEfV.js").then((n) => n.a);
+			const { clearSharedCodexAppServerClientAndWait } = await import("./shared-client-DlvmoLBJ.js").then((n) => n.a);
 			await clearSharedCodexAppServerClientAndWait();
 		}
 	};

package/dist/index.js

@@ -1,12 +1,12 @@
 import { createCodexAppServerAgentHarness } from "./harness.js";
-import { c as resolveCodexAppServerRuntimeOptions, s as readCodexPluginConfig, t as CODEX_PLUGINS_MARKETPLACE_NAME } from "./config-3ATInASk.js";
+import { c as resolveCodexAppServerRuntimeOptions, s as readCodexPluginConfig, t as CODEX_PLUGINS_MARKETPLACE_NAME } from "./config-B5pq6hEz.js";
 import { buildCodexMediaUnderstandingProvider } from "./media-understanding-provider.js";
 import { buildCodexProvider } from "./provider.js";
-import { i as describeControlFailure, n as buildCodexPluginAppCacheKey, t as requestCodexAppServerJson } from "./request-Czoa60Nt.js";
+import { i as describeControlFailure, n as buildCodexPluginAppCacheKey, t as requestCodexAppServerJson } from "./request-XPjLayGw.js";
 import { r as formatCodexDisplayText } from "./command-formatters-BRW7_Nu7.js";
-import { c as resolveCodexAppServerAuthAccountCacheKey, d as resolveCodexAppServerEnvApiKeyCacheKey, i as getSharedCodexAppServerClient, t as clearSharedCodexAppServerClientAndWait, u as resolveCodexAppServerAuthProfileIdForAgent } from "./shared-client-CnbrvEfV.js";
-import { a as resolveCodexCliSessionForBindingOnNode, c as handleCodexConversationInboundClaim, i as listCodexCliSessionsOnNode, n as createCodexCliSessionNodeInvokePolicies, o as resumeCodexCliSessionOnNode, s as handleCodexConversationBindingResolved, t as createCodexCliSessionNodeHostCommands } from "./node-cli-sessions-BLDFnUEF.js";
-import { a as defaultCodexAppInventoryCache, n as pluginReadParams, t as ensureCodexPluginActivation } from "./plugin-activation-BDU4e-NA.js";
+import { c as resolveCodexAppServerAuthAccountCacheKey, d as resolveCodexAppServerEnvApiKeyCacheKey, i as getSharedCodexAppServerClient, n as clearSharedCodexAppServerClientIfCurrentAndWait, u as resolveCodexAppServerAuthProfileIdForAgent } from "./shared-client-DlvmoLBJ.js";
+import { a as resolveCodexCliSessionForBindingOnNode, c as handleCodexConversationInboundClaim, i as listCodexCliSessionsOnNode, n as createCodexCliSessionNodeInvokePolicies, o as resumeCodexCliSessionOnNode, s as handleCodexConversationBindingResolved, t as createCodexCliSessionNodeHostCommands } from "./node-cli-sessions-BKhlcAB9.js";
+import { a as defaultCodexAppInventoryCache, n as pluginReadParams, t as ensureCodexPluginActivation } from "./plugin-activation-B49xb7pI.js";
 import { resolveLivePluginConfigObject } from "openclaw/plugin-sdk/plugin-config-runtime";
 import { definePluginEntry } from "openclaw/plugin-sdk/plugin-entry";
 import os from "node:os";
@@ -38,7 +38,7 @@ async function handleCodexCommand(ctx, options = {}) {
 	}
 }
 async function loadDefaultCodexSubcommandHandler() {
-	const { handleCodexSubcommand } = await import("./command-handlers-D6UDzndR.js");
+	const { handleCodexSubcommand } = await import("./command-handlers-jZV_1Ks9.js");
 	return handleCodexSubcommand;
 }
 //#endregion
@@ -765,15 +765,18 @@ function shouldReturnCodexPluginConfigPatch(ctx) {
 function prepareTargetCodexAppServer(ctx) {
 	const appServer = resolveTargetCodexAppServer(ctx);
 	const targets = resolveCodexMigrationTargets(ctx);
+	let warmedClient;
 	const ready = getSharedCodexAppServerClient({
 		startOptions: appServer.start,
 		timeoutMs: 6e4,
 		agentDir: targets.agentDir,
 		config: ctx.config
-	}).then(() => void 0, () => void 0);
+	}).then((client) => {
+		warmedClient = client;
+	}, () => void 0);
 	return { async dispose() {
 		await ready;
-		await clearSharedCodexAppServerClientAndWait({
+		await clearSharedCodexAppServerClientIfCurrentAndWait(warmedClient, {
 			exitTimeoutMs: 2e3,
 			forceKillDelayMs: 250
 		});

package/dist/media-understanding-provider.js

@@ -1,7 +1,7 @@
 import { CODEX_PROVIDER_ID, FALLBACK_CODEX_MODELS } from "./provider-catalog.js";
-import { c as resolveCodexAppServerRuntimeOptions } from "./config-3ATInASk.js";
-import { i as assertCodexTurnStartResponse, l as readCodexTurnCompletedNotification, o as readCodexErrorNotification, r as assertCodexThreadStartResponse } from "./protocol-validators-CSY0BFBo.js";
-import { i as readModelListResult } from "./models-BHS-8DS_.js";
+import { c as resolveCodexAppServerRuntimeOptions } from "./config-B5pq6hEz.js";
+import { i as assertCodexTurnStartResponse, l as readCodexTurnCompletedNotification, o as readCodexErrorNotification, r as assertCodexThreadStartResponse } from "./protocol-validators-BGBspNmF.js";
+import { i as readModelListResult } from "./models-C1zn2RN0.js";
 import { t as isJsonObject } from "./protocol-C9UWI98H.js";
 import { validateJsonSchemaValue } from "openclaw/plugin-sdk/json-schema-runtime";
 //#region extensions/codex/media-understanding-provider.ts
@@ -62,7 +62,7 @@ async function runBoundedCodexVisionTurn(params) {
 	const appServer = resolveCodexAppServerRuntimeOptions({ pluginConfig: params.options.pluginConfig });
 	const timeoutMs = Math.max(100, params.timeoutMs);
 	const ownsClient = !params.options.clientFactory;
-	const client = params.options.clientFactory ? await params.options.clientFactory(appServer.start, params.profile) : await import("./shared-client-CnbrvEfV.js").then((n) => n.a).then(({ createIsolatedCodexAppServerClient }) => createIsolatedCodexAppServerClient({
+	const client = params.options.clientFactory ? await params.options.clientFactory(appServer.start, params.profile) : await import("./shared-client-DlvmoLBJ.js").then((n) => n.a).then(({ createIsolatedCodexAppServerClient }) => createIsolatedCodexAppServerClient({
 		startOptions: appServer.start,
 		timeoutMs,
 		authProfileId: params.profile

package/dist/{models-BHS-8DS_.js → models-C1zn2RN0.js}

@@ -1,5 +1,5 @@
 import { t as __exportAll } from "./rolldown-runtime-DUslC3ob.js";
-import { s as readCodexModelListResponse } from "./protocol-validators-CSY0BFBo.js";
+import { s as readCodexModelListResponse } from "./protocol-validators-BGBspNmF.js";
 //#region extensions/codex/src/app-server/models.ts
 var models_exports = /* @__PURE__ */ __exportAll({
 	listAllCodexAppServerModels: () => listAllCodexAppServerModels,
@@ -39,7 +39,7 @@ async function listAllCodexAppServerModels(options = {}) {
 async function withCodexAppServerModelClient(options, run) {
 	const timeoutMs = options.timeoutMs ?? 2500;
 	const useSharedClient = options.sharedClient !== false;
-	const { createIsolatedCodexAppServerClient, getSharedCodexAppServerClient } = await import("./shared-client-CnbrvEfV.js").then((n) => n.a);
+	const { createIsolatedCodexAppServerClient, getSharedCodexAppServerClient } = await import("./shared-client-DlvmoLBJ.js").then((n) => n.a);
 	const client = useSharedClient ? await getSharedCodexAppServerClient({
 		startOptions: options.startOptions,
 		timeoutMs,

package/dist/{node-cli-sessions-BLDFnUEF.js → node-cli-sessions-BKhlcAB9.js}

@@ -1,9 +1,9 @@
-import { a as isCodexFastServiceTier, c as resolveCodexAppServerRuntimeOptions, r as codexSandboxPolicyForTurn } from "./config-3ATInASk.js";
+import { a as isCodexFastServiceTier, c as resolveCodexAppServerRuntimeOptions, r as codexSandboxPolicyForTurn } from "./config-B5pq6hEz.js";
 import { t as isJsonObject } from "./protocol-C9UWI98H.js";
-import { r as CODEX_CONTROL_METHODS } from "./request-Czoa60Nt.js";
+import { r as CODEX_CONTROL_METHODS } from "./request-XPjLayGw.js";
 import { r as formatCodexDisplayText } from "./command-formatters-BRW7_Nu7.js";
-import { i as getSharedCodexAppServerClient, u as resolveCodexAppServerAuthProfileIdForAgent } from "./shared-client-CnbrvEfV.js";
-import { i as readCodexAppServerBinding, n as isCodexAppServerNativeAuthProfile, o as writeCodexAppServerBinding, r as normalizeCodexAppServerBindingModelProvider, t as clearCodexAppServerBinding } from "./session-binding-DbdVqMzW.js";
+import { i as getSharedCodexAppServerClient, u as resolveCodexAppServerAuthProfileIdForAgent } from "./shared-client-DlvmoLBJ.js";
+import { i as readCodexAppServerBinding, n as isCodexAppServerNativeAuthProfile, o as writeCodexAppServerBinding, r as normalizeCodexAppServerBindingModelProvider, t as clearCodexAppServerBinding } from "./session-binding-DqApZIgD.js";
 import os from "node:os";
 import { formatErrorMessage } from "openclaw/plugin-sdk/agent-harness-runtime";
 import { spawn } from "node:child_process";

package/dist/{plugin-activation-BDU4e-NA.js → plugin-activation-B49xb7pI.js}

@@ -1,4 +1,4 @@
-import { t as CODEX_PLUGINS_MARKETPLACE_NAME, u as resolveCodexPluginsPolicy } from "./config-3ATInASk.js";
+import { t as CODEX_PLUGINS_MARKETPLACE_NAME, u as resolveCodexPluginsPolicy } from "./config-B5pq6hEz.js";
 import "node:fs/promises";
 import "node:path";
 var CodexAppInventoryCache = class {

package/dist/{protocol-validators-CSY0BFBo.js → protocol-validators-BGBspNmF.js}

@@ -318,6 +318,12 @@ var ThreadResumeResponse_default = {
 			"anyOf": [{ "$ref": "#/definitions/PermissionProfile" }, { "type": "null" }]
 		},
 		"reasoningEffort": { "anyOf": [{ "$ref": "#/definitions/ReasoningEffort" }, { "type": "null" }] },
+		"runtimeWorkspaceRoots": {
+			"description": "Thread-scoped runtime workspace roots used to materialize `:workspace_roots`.",
+			"default": [],
+			"type": "array",
+			"items": { "$ref": "#/definitions/AbsolutePathBuf" }
+		},
 		"sandbox": {
 			"description": "Legacy sandbox policy retained for compatibility. Experimental clients should prefer `permissionProfile` when they need exact runtime permissions.",
 			"allOf": [{ "$ref": "#/definitions/SandboxPolicy" }]
@@ -342,29 +348,9 @@ var ThreadResumeResponse_default = {
 				"id": {
 					"description": "Identifier from `default_permissions` or the implicit built-in default, such as `:workspace` or a user-defined `[permissions.<id>]` profile.",
 					"type": "string"
-				},
-				"modifications": {
-					"description": "Bounded user-requested modifications applied on top of the named profile, if any.",
-					"default": [],
-					"type": "array",
-					"items": { "$ref": "#/definitions/ActivePermissionProfileModification" }
 				}
 			}
 		},
-		"ActivePermissionProfileModification": { "oneOf": [{
-			"description": "Additional concrete directory that should be writable.",
-			"type": "object",
-			"required": ["path", "type"],
-			"properties": {
-				"path": { "$ref": "#/definitions/AbsolutePathBuf" },
-				"type": {
-					"type": "string",
-					"enum": ["additionalWritableRoot"],
-					"title": "AdditionalWritableRootActivePermissionProfileModificationType"
-				}
-			},
-			"title": "AdditionalWritableRootActivePermissionProfileModification"
-		}] },
 		"AgentPath": { "type": "string" },
 		"ApprovalsReviewer": {
 			"description": "Configures who approval requests are routed to for review. Examples include sandbox escapes, blocked network access, MCP approval prompts, and ARC escalations. Defaults to `user`. `auto_review` uses a carefully prompted subagent to gather relevant context and apply a risk-based decision framework before approving or denying the request. The legacy value `guardian_subagent` is accepted for compatibility.",
@@ -2035,6 +2021,12 @@ var ThreadStartResponse_default = {
 			"anyOf": [{ "$ref": "#/definitions/PermissionProfile" }, { "type": "null" }]
 		},
 		"reasoningEffort": { "anyOf": [{ "$ref": "#/definitions/ReasoningEffort" }, { "type": "null" }] },
+		"runtimeWorkspaceRoots": {
+			"description": "Thread-scoped runtime workspace roots used to materialize `:workspace_roots`.",
+			"default": [],
+			"type": "array",
+			"items": { "$ref": "#/definitions/AbsolutePathBuf" }
+		},
 		"sandbox": {
 			"description": "Legacy sandbox policy retained for compatibility. Experimental clients should prefer `permissionProfile` when they need exact runtime permissions.",
 			"allOf": [{ "$ref": "#/definitions/SandboxPolicy" }]
@@ -2059,29 +2051,9 @@ var ThreadStartResponse_default = {
 				"id": {
 					"description": "Identifier from `default_permissions` or the implicit built-in default, such as `:workspace` or a user-defined `[permissions.<id>]` profile.",
 					"type": "string"
-				},
-				"modifications": {
-					"description": "Bounded user-requested modifications applied on top of the named profile, if any.",
-					"default": [],
-					"type": "array",
-					"items": { "$ref": "#/definitions/ActivePermissionProfileModification" }
 				}
 			}
 		},
-		"ActivePermissionProfileModification": { "oneOf": [{
-			"description": "Additional concrete directory that should be writable.",
-			"type": "object",
-			"required": ["path", "type"],
-			"properties": {
-				"path": { "$ref": "#/definitions/AbsolutePathBuf" },
-				"type": {
-					"type": "string",
-					"enum": ["additionalWritableRoot"],
-					"title": "AdditionalWritableRootActivePermissionProfileModificationType"
-				}
-			},
-			"title": "AdditionalWritableRootActivePermissionProfileModification"
-		}] },
 		"AgentPath": { "type": "string" },
 		"ApprovalsReviewer": {
 			"description": "Configures who approval requests are routed to for review. Examples include sandbox escapes, blocked network access, MCP approval prompts, and ARC escalations. Defaults to `user`. `auto_review` uses a carefully prompted subagent to gather relevant context and apply a risk-based decision framework before approving or denying the request. The legacy value `guardian_subagent` is accepted for compatibility.",

package/dist/provider.js

@@ -1,5 +1,5 @@
 import { CODEX_APP_SERVER_AUTH_MARKER, CODEX_BASE_URL, CODEX_PROVIDER_ID, FALLBACK_CODEX_MODELS, buildCodexModelDefinition, buildCodexProviderConfig } from "./provider-catalog.js";
-import { c as resolveCodexAppServerRuntimeOptions, s as readCodexPluginConfig } from "./config-3ATInASk.js";
+import { c as resolveCodexAppServerRuntimeOptions, s as readCodexPluginConfig } from "./config-B5pq6hEz.js";
 import { resolveCodexSystemPromptContribution } from "./prompt-overlay.js";
 import { resolvePluginConfigObject } from "openclaw/plugin-sdk/plugin-config-runtime";
 import { createSubsystemLogger } from "openclaw/plugin-sdk/core";
@@ -123,7 +123,7 @@ async function listModelsBestEffort(params) {
 	}
 }
 async function listCodexAppServerModelsLazy(options) {
-	const { listCodexAppServerModels } = await import("./models-BHS-8DS_.js").then((n) => n.r);
+	const { listCodexAppServerModels } = await import("./models-C1zn2RN0.js").then((n) => n.r);
 	return listCodexAppServerModels(options);
 }
 function normalizeTimeoutMs(value) {

package/dist/{request-Czoa60Nt.js → request-XPjLayGw.js}

@@ -1,6 +1,6 @@
-import { n as CodexAppServerRpcError } from "./client-CA7amCZ8.js";
-import { f as resolveCodexAppServerHomeDir, i as getSharedCodexAppServerClient, o as withTimeout, r as createIsolatedCodexAppServerClient } from "./shared-client-CnbrvEfV.js";
-import { i as buildCodexAppInventoryCacheKey } from "./plugin-activation-BDU4e-NA.js";
+import { n as CodexAppServerRpcError } from "./client-6FkrXfaz.js";
+import { f as resolveCodexAppServerHomeDir, i as getSharedCodexAppServerClient, o as withTimeout, r as createIsolatedCodexAppServerClient } from "./shared-client-DlvmoLBJ.js";
+import { i as buildCodexAppInventoryCacheKey } from "./plugin-activation-B49xb7pI.js";
 import { createHash } from "node:crypto";
 //#region extensions/codex/src/app-server/capabilities.ts
 const CODEX_CONTROL_METHODS = {