@openclaw/codex 2026.5.16-beta.3 → 2026.5.16-beta.4

package/dist/{client-CA7amCZ8.js → client-6FkrXfaz.js}

@@ -1,4 +1,4 @@
-import { c as resolveCodexAppServerRuntimeOptions } from "./config-3ATInASk.js";
+import { c as resolveCodexAppServerRuntimeOptions } from "./config-B5pq6hEz.js";
 import { n as isRpcResponse } from "./protocol-C9UWI98H.js";
 import { createInterface } from "node:readline";
 import { OPENCLAW_VERSION, embeddedAgentLog } from "openclaw/plugin-sdk/agent-harness-runtime";

package/dist/{client-factory-DwzPofwS.js → client-factory-9L6Ie1dC.js}

@@ -1,5 +1,5 @@
 //#region extensions/codex/src/app-server/client-factory.ts
-const defaultCodexAppServerClientFactory = (startOptions, authProfileId, agentDir, config) => import("./shared-client-CnbrvEfV.js").then((n) => n.a).then(({ getSharedCodexAppServerClient }) => getSharedCodexAppServerClient({
+const defaultCodexAppServerClientFactory = (startOptions, authProfileId, agentDir, config) => import("./shared-client-DlvmoLBJ.js").then((n) => n.a).then(({ getSharedCodexAppServerClient }) => getSharedCodexAppServerClient({
 	startOptions,
 	authProfileId,
 	agentDir,

package/dist/{command-handlers-C4F8BChC.js → command-handlers-jZV_1Ks9.js}

@@ -1,11 +1,11 @@
-import { a as isCodexFastServiceTier, c as resolveCodexAppServerRuntimeOptions } from "./config-3ATInASk.js";
-import { n as listCodexAppServerModels, t as listAllCodexAppServerModels } from "./models-BZLMz9WS.js";
+import { a as isCodexFastServiceTier, c as resolveCodexAppServerRuntimeOptions } from "./config-B5pq6hEz.js";
+import { n as listCodexAppServerModels, t as listAllCodexAppServerModels } from "./models-C1zn2RN0.js";
 import { t as isJsonObject } from "./protocol-C9UWI98H.js";
-import { i as describeControlFailure, r as CODEX_CONTROL_METHODS, t as requestCodexAppServerJson } from "./request-Czoa60Nt.js";
+import { i as describeControlFailure, r as CODEX_CONTROL_METHODS, t as requestCodexAppServerJson } from "./request-XPjLayGw.js";
 import { a as formatComputerUseStatus, c as formatThreads, i as formatCodexStatus, l as readString$1, n as formatAccount, o as formatList, p as summarizeCodexAccountUsage, r as formatCodexDisplayText, s as formatModels, t as buildHelp } from "./command-formatters-BRW7_Nu7.js";
-import { i as readCodexAppServerBinding, o as writeCodexAppServerBinding, t as clearCodexAppServerBinding } from "./session-binding-DbdVqMzW.js";
-import { _ as steerCodexConversationTurn, b as readCodexConversationBindingData, d as parseCodexFastModeArg, f as parseCodexPermissionsModeArg, g as setCodexConversationPermissions, h as setCodexConversationModel, l as startCodexConversationThread, m as setCodexConversationFastMode, p as readCodexConversationActiveTurn, r as formatCodexCliSessions, u as formatPermissionsMode, v as stopCodexConversationTurn, x as resolveCodexDefaultWorkspaceDir, y as createCodexCliNodeConversationBindingData } from "./node-cli-sessions-BLDFnUEF.js";
-import { n as installCodexComputerUse, r as readCodexComputerUseStatus } from "./computer-use-BX02ojP4.js";
+import { i as readCodexAppServerBinding, o as writeCodexAppServerBinding, t as clearCodexAppServerBinding } from "./session-binding-DqApZIgD.js";
+import { _ as steerCodexConversationTurn, b as readCodexConversationBindingData, d as parseCodexFastModeArg, f as parseCodexPermissionsModeArg, g as setCodexConversationPermissions, h as setCodexConversationModel, l as startCodexConversationThread, m as setCodexConversationFastMode, p as readCodexConversationActiveTurn, r as formatCodexCliSessions, u as formatPermissionsMode, v as stopCodexConversationTurn, x as resolveCodexDefaultWorkspaceDir, y as createCodexCliNodeConversationBindingData } from "./node-cli-sessions-BKhlcAB9.js";
+import { n as installCodexComputerUse, r as readCodexComputerUseStatus } from "./computer-use-UJ3dxrXF.js";
 import { n as rememberCodexRateLimits } from "./rate-limit-cache-dvhq-4pi.js";
 import crypto from "node:crypto";
 import { ensureAuthProfileStore, findNormalizedProviderValue, resolveAuthProfileEligibility, resolveAuthProfileOrder, resolveDefaultAgentDir, resolveProfileUnusableUntilForDisplay } from "openclaw/plugin-sdk/agent-runtime";

package/dist/{compact-96QPqIAu.js → compact-UKyG6Pw2.js}

@@ -1,7 +1,7 @@
-import { c as resolveCodexAppServerRuntimeOptions } from "./config-3ATInASk.js";
+import { c as resolveCodexAppServerRuntimeOptions } from "./config-B5pq6hEz.js";
 import { t as isJsonObject } from "./protocol-C9UWI98H.js";
-import { i as readCodexAppServerBinding, t as clearCodexAppServerBinding } from "./session-binding-DbdVqMzW.js";
-import { t as defaultCodexAppServerClientFactory } from "./client-factory-DwzPofwS.js";
+import { i as readCodexAppServerBinding, t as clearCodexAppServerBinding } from "./session-binding-DqApZIgD.js";
+import { t as defaultCodexAppServerClientFactory } from "./client-factory-9L6Ie1dC.js";
 import { embeddedAgentLog, formatErrorMessage, isActiveHarnessContextEngine, resolveContextEngineOwnerPluginId, runHarnessContextEngineMaintenance } from "openclaw/plugin-sdk/agent-harness-runtime";
 //#region extensions/codex/src/app-server/compact.ts
 const DEFAULT_CODEX_COMPACTION_WAIT_TIMEOUT_MS = 300 * 1e3;

package/dist/{computer-use-BX02ojP4.js → computer-use-UJ3dxrXF.js}

@@ -1,5 +1,5 @@
-import { c as resolveCodexAppServerRuntimeOptions, l as resolveCodexComputerUseConfig } from "./config-3ATInASk.js";
-import { i as describeControlFailure, t as requestCodexAppServerJson } from "./request-Czoa60Nt.js";
+import { c as resolveCodexAppServerRuntimeOptions, l as resolveCodexComputerUseConfig } from "./config-B5pq6hEz.js";
+import { i as describeControlFailure, t as requestCodexAppServerJson } from "./request-XPjLayGw.js";
 import { existsSync } from "node:fs";
 //#region extensions/codex/src/app-server/computer-use.ts
 var CodexComputerUseSetupError = class extends Error {

package/dist/{config-3ATInASk.js → config-B5pq6hEz.js}

@@ -3,7 +3,8 @@ import { readFileSync } from "node:fs";
 import { hostname } from "node:os";
 import { z } from "zod";
 //#region extensions/codex/src/app-server/config.ts
-const START_OPTIONS_KEY_SECRET = randomBytes(32);
+const START_OPTIONS_KEY_SECRET_SYMBOL = Symbol.for("openclaw.codexAppServerStartOptionsKeySecret");
+const START_OPTIONS_KEY_SECRET = getStartOptionsKeySecret();
 const UNIX_CODEX_REQUIREMENTS_PATH = "/etc/codex/requirements.toml";
 const WINDOWS_CODEX_REQUIREMENTS_SUFFIX = "\\OpenAI\\Codex\\requirements.toml";
 const CODEX_PLUGINS_MARKETPLACE_NAME = "openai-curated";
@@ -472,6 +473,11 @@ function hashSecretForKey(value, label) {
 	if (!value) return null;
 	return createHmac("sha256", START_OPTIONS_KEY_SECRET).update(label).update("\0").update(value).digest("hex");
 }
+function getStartOptionsKeySecret() {
+	const globalState = globalThis;
+	globalState[START_OPTIONS_KEY_SECRET_SYMBOL] ??= randomBytes(32);
+	return globalState[START_OPTIONS_KEY_SECRET_SYMBOL];
+}
 function splitShellWords(value) {
 	const words = [];
 	let current = "";

package/dist/harness.js

@@ -18,28 +18,28 @@ function createCodexAppServerAgentHarness(options) {
 			};
 		},
 		runAttempt: async (params) => {
-			const { runCodexAppServerAttempt } = await import("./run-attempt-B3nk5oT1.js");
+			const { runCodexAppServerAttempt } = await import("./run-attempt-DMKAwtUV.js");
 			return runCodexAppServerAttempt(params, {
 				pluginConfig: options?.pluginConfig,
 				nativeHookRelay: { enabled: true }
 			});
 		},
 		runSideQuestion: async (params) => {
-			const { runCodexAppServerSideQuestion } = await import("./side-question-D3nH-Jk1.js");
+			const { runCodexAppServerSideQuestion } = await import("./side-question-BYYJZq23.js");
 			return runCodexAppServerSideQuestion(params, { pluginConfig: options?.pluginConfig });
 		},
 		compact: async (params) => {
-			const { maybeCompactCodexAppServerSession } = await import("./compact-96QPqIAu.js");
+			const { maybeCompactCodexAppServerSession } = await import("./compact-UKyG6Pw2.js");
 			return maybeCompactCodexAppServerSession(params, { pluginConfig: options?.pluginConfig });
 		},
 		reset: async (params) => {
 			if (params.sessionFile) {
-				const { clearCodexAppServerBinding } = await import("./session-binding-DbdVqMzW.js").then((n) => n.a);
+				const { clearCodexAppServerBinding } = await import("./session-binding-DqApZIgD.js").then((n) => n.a);
 				await clearCodexAppServerBinding(params.sessionFile);
 			}
 		},
 		dispose: async () => {
-			const { clearSharedCodexAppServerClientAndWait } = await import("./shared-client-CnbrvEfV.js").then((n) => n.a);
+			const { clearSharedCodexAppServerClientAndWait } = await import("./shared-client-DlvmoLBJ.js").then((n) => n.a);
 			await clearSharedCodexAppServerClientAndWait();
 		}
 	};

package/dist/index.js

@@ -1,12 +1,12 @@
 import { createCodexAppServerAgentHarness } from "./harness.js";
-import { c as resolveCodexAppServerRuntimeOptions, s as readCodexPluginConfig, t as CODEX_PLUGINS_MARKETPLACE_NAME } from "./config-3ATInASk.js";
+import { c as resolveCodexAppServerRuntimeOptions, s as readCodexPluginConfig, t as CODEX_PLUGINS_MARKETPLACE_NAME } from "./config-B5pq6hEz.js";
 import { buildCodexMediaUnderstandingProvider } from "./media-understanding-provider.js";
 import { buildCodexProvider } from "./provider.js";
-import { i as describeControlFailure, n as buildCodexPluginAppCacheKey, t as requestCodexAppServerJson } from "./request-Czoa60Nt.js";
+import { i as describeControlFailure, n as buildCodexPluginAppCacheKey, t as requestCodexAppServerJson } from "./request-XPjLayGw.js";
 import { r as formatCodexDisplayText } from "./command-formatters-BRW7_Nu7.js";
-import { c as resolveCodexAppServerAuthAccountCacheKey, d as resolveCodexAppServerEnvApiKeyCacheKey, i as getSharedCodexAppServerClient, t as clearSharedCodexAppServerClientAndWait, u as resolveCodexAppServerAuthProfileIdForAgent } from "./shared-client-CnbrvEfV.js";
-import { a as resolveCodexCliSessionForBindingOnNode, c as handleCodexConversationInboundClaim, i as listCodexCliSessionsOnNode, n as createCodexCliSessionNodeInvokePolicies, o as resumeCodexCliSessionOnNode, s as handleCodexConversationBindingResolved, t as createCodexCliSessionNodeHostCommands } from "./node-cli-sessions-BLDFnUEF.js";
-import { a as defaultCodexAppInventoryCache, n as pluginReadParams, t as ensureCodexPluginActivation } from "./plugin-activation-BDU4e-NA.js";
+import { c as resolveCodexAppServerAuthAccountCacheKey, d as resolveCodexAppServerEnvApiKeyCacheKey, i as getSharedCodexAppServerClient, n as clearSharedCodexAppServerClientIfCurrentAndWait, u as resolveCodexAppServerAuthProfileIdForAgent } from "./shared-client-DlvmoLBJ.js";
+import { a as resolveCodexCliSessionForBindingOnNode, c as handleCodexConversationInboundClaim, i as listCodexCliSessionsOnNode, n as createCodexCliSessionNodeInvokePolicies, o as resumeCodexCliSessionOnNode, s as handleCodexConversationBindingResolved, t as createCodexCliSessionNodeHostCommands } from "./node-cli-sessions-BKhlcAB9.js";
+import { a as defaultCodexAppInventoryCache, n as pluginReadParams, t as ensureCodexPluginActivation } from "./plugin-activation-B49xb7pI.js";
 import { resolveLivePluginConfigObject } from "openclaw/plugin-sdk/plugin-config-runtime";
 import { definePluginEntry } from "openclaw/plugin-sdk/plugin-entry";
 import os from "node:os";
@@ -38,7 +38,7 @@ async function handleCodexCommand(ctx, options = {}) {
 	}
 }
 async function loadDefaultCodexSubcommandHandler() {
-	const { handleCodexSubcommand } = await import("./command-handlers-C4F8BChC.js");
+	const { handleCodexSubcommand } = await import("./command-handlers-jZV_1Ks9.js");
 	return handleCodexSubcommand;
 }
 //#endregion
@@ -765,15 +765,18 @@ function shouldReturnCodexPluginConfigPatch(ctx) {
 function prepareTargetCodexAppServer(ctx) {
 	const appServer = resolveTargetCodexAppServer(ctx);
 	const targets = resolveCodexMigrationTargets(ctx);
+	let warmedClient;
 	const ready = getSharedCodexAppServerClient({
 		startOptions: appServer.start,
 		timeoutMs: 6e4,
 		agentDir: targets.agentDir,
 		config: ctx.config
-	}).then(() => void 0, () => void 0);
+	}).then((client) => {
+		warmedClient = client;
+	}, () => void 0);
 	return { async dispose() {
 		await ready;
-		await clearSharedCodexAppServerClientAndWait({
+		await clearSharedCodexAppServerClientIfCurrentAndWait(warmedClient, {
 			exitTimeoutMs: 2e3,
 			forceKillDelayMs: 250
 		});

package/dist/media-understanding-provider.js

@@ -1,7 +1,7 @@
 import { CODEX_PROVIDER_ID, FALLBACK_CODEX_MODELS } from "./provider-catalog.js";
-import { c as resolveCodexAppServerRuntimeOptions } from "./config-3ATInASk.js";
+import { c as resolveCodexAppServerRuntimeOptions } from "./config-B5pq6hEz.js";
 import { i as assertCodexTurnStartResponse, l as readCodexTurnCompletedNotification, o as readCodexErrorNotification, r as assertCodexThreadStartResponse } from "./protocol-validators-BGBspNmF.js";
-import { i as readModelListResult } from "./models-BZLMz9WS.js";
+import { i as readModelListResult } from "./models-C1zn2RN0.js";
 import { t as isJsonObject } from "./protocol-C9UWI98H.js";
 import { validateJsonSchemaValue } from "openclaw/plugin-sdk/json-schema-runtime";
 //#region extensions/codex/media-understanding-provider.ts
@@ -62,7 +62,7 @@ async function runBoundedCodexVisionTurn(params) {
 	const appServer = resolveCodexAppServerRuntimeOptions({ pluginConfig: params.options.pluginConfig });
 	const timeoutMs = Math.max(100, params.timeoutMs);
 	const ownsClient = !params.options.clientFactory;
-	const client = params.options.clientFactory ? await params.options.clientFactory(appServer.start, params.profile) : await import("./shared-client-CnbrvEfV.js").then((n) => n.a).then(({ createIsolatedCodexAppServerClient }) => createIsolatedCodexAppServerClient({
+	const client = params.options.clientFactory ? await params.options.clientFactory(appServer.start, params.profile) : await import("./shared-client-DlvmoLBJ.js").then((n) => n.a).then(({ createIsolatedCodexAppServerClient }) => createIsolatedCodexAppServerClient({
 		startOptions: appServer.start,
 		timeoutMs,
 		authProfileId: params.profile

package/dist/{models-BZLMz9WS.js → models-C1zn2RN0.js}

@@ -39,7 +39,7 @@ async function listAllCodexAppServerModels(options = {}) {
 async function withCodexAppServerModelClient(options, run) {
 	const timeoutMs = options.timeoutMs ?? 2500;
 	const useSharedClient = options.sharedClient !== false;
-	const { createIsolatedCodexAppServerClient, getSharedCodexAppServerClient } = await import("./shared-client-CnbrvEfV.js").then((n) => n.a);
+	const { createIsolatedCodexAppServerClient, getSharedCodexAppServerClient } = await import("./shared-client-DlvmoLBJ.js").then((n) => n.a);
 	const client = useSharedClient ? await getSharedCodexAppServerClient({
 		startOptions: options.startOptions,
 		timeoutMs,

package/dist/{node-cli-sessions-BLDFnUEF.js → node-cli-sessions-BKhlcAB9.js}

@@ -1,9 +1,9 @@
-import { a as isCodexFastServiceTier, c as resolveCodexAppServerRuntimeOptions, r as codexSandboxPolicyForTurn } from "./config-3ATInASk.js";
+import { a as isCodexFastServiceTier, c as resolveCodexAppServerRuntimeOptions, r as codexSandboxPolicyForTurn } from "./config-B5pq6hEz.js";
 import { t as isJsonObject } from "./protocol-C9UWI98H.js";
-import { r as CODEX_CONTROL_METHODS } from "./request-Czoa60Nt.js";
+import { r as CODEX_CONTROL_METHODS } from "./request-XPjLayGw.js";
 import { r as formatCodexDisplayText } from "./command-formatters-BRW7_Nu7.js";
-import { i as getSharedCodexAppServerClient, u as resolveCodexAppServerAuthProfileIdForAgent } from "./shared-client-CnbrvEfV.js";
-import { i as readCodexAppServerBinding, n as isCodexAppServerNativeAuthProfile, o as writeCodexAppServerBinding, r as normalizeCodexAppServerBindingModelProvider, t as clearCodexAppServerBinding } from "./session-binding-DbdVqMzW.js";
+import { i as getSharedCodexAppServerClient, u as resolveCodexAppServerAuthProfileIdForAgent } from "./shared-client-DlvmoLBJ.js";
+import { i as readCodexAppServerBinding, n as isCodexAppServerNativeAuthProfile, o as writeCodexAppServerBinding, r as normalizeCodexAppServerBindingModelProvider, t as clearCodexAppServerBinding } from "./session-binding-DqApZIgD.js";
 import os from "node:os";
 import { formatErrorMessage } from "openclaw/plugin-sdk/agent-harness-runtime";
 import { spawn } from "node:child_process";

package/dist/{plugin-activation-BDU4e-NA.js → plugin-activation-B49xb7pI.js}

@@ -1,4 +1,4 @@
-import { t as CODEX_PLUGINS_MARKETPLACE_NAME, u as resolveCodexPluginsPolicy } from "./config-3ATInASk.js";
+import { t as CODEX_PLUGINS_MARKETPLACE_NAME, u as resolveCodexPluginsPolicy } from "./config-B5pq6hEz.js";
 import "node:fs/promises";
 import "node:path";
 var CodexAppInventoryCache = class {

package/dist/provider.js

@@ -1,5 +1,5 @@
 import { CODEX_APP_SERVER_AUTH_MARKER, CODEX_BASE_URL, CODEX_PROVIDER_ID, FALLBACK_CODEX_MODELS, buildCodexModelDefinition, buildCodexProviderConfig } from "./provider-catalog.js";
-import { c as resolveCodexAppServerRuntimeOptions, s as readCodexPluginConfig } from "./config-3ATInASk.js";
+import { c as resolveCodexAppServerRuntimeOptions, s as readCodexPluginConfig } from "./config-B5pq6hEz.js";
 import { resolveCodexSystemPromptContribution } from "./prompt-overlay.js";
 import { resolvePluginConfigObject } from "openclaw/plugin-sdk/plugin-config-runtime";
 import { createSubsystemLogger } from "openclaw/plugin-sdk/core";
@@ -123,7 +123,7 @@ async function listModelsBestEffort(params) {
 	}
 }
 async function listCodexAppServerModelsLazy(options) {
-	const { listCodexAppServerModels } = await import("./models-BZLMz9WS.js").then((n) => n.r);
+	const { listCodexAppServerModels } = await import("./models-C1zn2RN0.js").then((n) => n.r);
 	return listCodexAppServerModels(options);
 }
 function normalizeTimeoutMs(value) {

package/dist/{request-Czoa60Nt.js → request-XPjLayGw.js}

@@ -1,6 +1,6 @@
-import { n as CodexAppServerRpcError } from "./client-CA7amCZ8.js";
-import { f as resolveCodexAppServerHomeDir, i as getSharedCodexAppServerClient, o as withTimeout, r as createIsolatedCodexAppServerClient } from "./shared-client-CnbrvEfV.js";
-import { i as buildCodexAppInventoryCacheKey } from "./plugin-activation-BDU4e-NA.js";
+import { n as CodexAppServerRpcError } from "./client-6FkrXfaz.js";
+import { f as resolveCodexAppServerHomeDir, i as getSharedCodexAppServerClient, o as withTimeout, r as createIsolatedCodexAppServerClient } from "./shared-client-DlvmoLBJ.js";
+import { i as buildCodexAppInventoryCacheKey } from "./plugin-activation-B49xb7pI.js";
 import { createHash } from "node:crypto";
 //#region extensions/codex/src/app-server/capabilities.ts
 const CODEX_CONTROL_METHODS = {

package/dist/{run-attempt-B3nk5oT1.js → run-attempt-DMKAwtUV.js}

@@ -1,16 +1,16 @@
-import { c as resolveCodexAppServerRuntimeOptions, d as withMcpElicitationsApprovalPolicy, i as isCodexAppServerApprovalPolicyAllowedByRequirements, s as readCodexPluginConfig, u as resolveCodexPluginsPolicy } from "./config-3ATInASk.js";
+import { c as resolveCodexAppServerRuntimeOptions, d as withMcpElicitationsApprovalPolicy, i as isCodexAppServerApprovalPolicyAllowedByRequirements, s as readCodexPluginConfig, u as resolveCodexPluginsPolicy } from "./config-B5pq6hEz.js";
 import { a as readCodexDynamicToolCallParams, c as readCodexTurn, i as assertCodexTurnStartResponse } from "./protocol-validators-BGBspNmF.js";
 import { t as isJsonObject } from "./protocol-C9UWI98H.js";
-import { i as isCodexAppServerConnectionClosedError, r as isCodexAppServerApprovalRequest } from "./client-CA7amCZ8.js";
-import { n as buildCodexPluginAppCacheKey, r as CODEX_CONTROL_METHODS } from "./request-Czoa60Nt.js";
+import { i as isCodexAppServerConnectionClosedError, r as isCodexAppServerApprovalRequest } from "./client-6FkrXfaz.js";
+import { n as buildCodexPluginAppCacheKey, r as CODEX_CONTROL_METHODS } from "./request-XPjLayGw.js";
 import { d as resolveCodexUsageLimitResetAtMs, f as shouldRefreshCodexRateLimitsForUsageLimitMessage, r as formatCodexDisplayText, u as formatCodexUsageLimitErrorMessage } from "./command-formatters-BRW7_Nu7.js";
-import { c as resolveCodexAppServerAuthAccountCacheKey, d as resolveCodexAppServerEnvApiKeyCacheKey, l as resolveCodexAppServerAuthProfileId, n as clearSharedCodexAppServerClientIfCurrent, s as refreshCodexAppServerAuthTokens, u as resolveCodexAppServerAuthProfileIdForAgent } from "./shared-client-CnbrvEfV.js";
-import { i as readCodexAppServerBinding, t as clearCodexAppServerBinding } from "./session-binding-DbdVqMzW.js";
-import { a as defaultCodexAppInventoryCache } from "./plugin-activation-BDU4e-NA.js";
-import { S as normalizeCodexDynamicToolName, _ as projectContextEngineAssemblyForCodex, b as createCodexDynamicToolBridge, c as codexDynamicToolsFingerprint, f as startOrResumeThread, g as shouldBuildCodexPluginThreadConfig, h as mergeCodexThreadConfigs, i as buildDeveloperInstructions, l as isContextEngineBindingCompatible, m as buildCodexPluginThreadConfigInputFingerprint, p as buildCodexPluginThreadConfig, r as buildContextEngineBinding, s as buildTurnStartParams, t as areCodexDynamicToolFingerprintsCompatible, v as resolveCodexContextEngineProjectionMaxChars, x as filterCodexDynamicTools, y as resolveCodexContextEngineProjectionReserveTokens } from "./thread-lifecycle-D2sxRPdz.js";
-import { t as defaultCodexAppServerClientFactory } from "./client-factory-DwzPofwS.js";
+import { c as resolveCodexAppServerAuthAccountCacheKey, d as resolveCodexAppServerEnvApiKeyCacheKey, l as resolveCodexAppServerAuthProfileId, s as refreshCodexAppServerAuthTokens, t as clearSharedCodexAppServerClientIfCurrent, u as resolveCodexAppServerAuthProfileIdForAgent } from "./shared-client-DlvmoLBJ.js";
+import { i as readCodexAppServerBinding, t as clearCodexAppServerBinding } from "./session-binding-DqApZIgD.js";
+import { a as defaultCodexAppInventoryCache } from "./plugin-activation-B49xb7pI.js";
+import { S as normalizeCodexDynamicToolName, _ as projectContextEngineAssemblyForCodex, b as createCodexDynamicToolBridge, c as codexDynamicToolsFingerprint, f as startOrResumeThread, g as shouldBuildCodexPluginThreadConfig, h as mergeCodexThreadConfigs, i as buildDeveloperInstructions, l as isContextEngineBindingCompatible, m as buildCodexPluginThreadConfigInputFingerprint, p as buildCodexPluginThreadConfig, r as buildContextEngineBinding, s as buildTurnStartParams, t as areCodexDynamicToolFingerprintsCompatible, v as resolveCodexContextEngineProjectionMaxChars, x as filterCodexDynamicTools, y as resolveCodexContextEngineProjectionReserveTokens } from "./thread-lifecycle-wcyYqwrl.js";
+import { t as defaultCodexAppServerClientFactory } from "./client-factory-9L6Ie1dC.js";
 import { n as handleCodexAppServerElicitationRequest, r as handleCodexAppServerApprovalRequest, t as filterToolsForVisionInputs } from "./vision-tools-Cm_YicZb.js";
-import { t as ensureCodexComputerUse } from "./computer-use-BX02ojP4.js";
+import { t as ensureCodexComputerUse } from "./computer-use-UJ3dxrXF.js";
 import { n as rememberCodexRateLimits, t as readRecentCodexRateLimits } from "./rate-limit-cache-dvhq-4pi.js";
 import { createHash } from "node:crypto";
 import nodeFs from "node:fs";
@@ -2644,7 +2644,7 @@ async function runCodexAppServerAttempt(params, options = {}) {
 		prePromptMessageCount = projection.prePromptMessageCount;
 	}
 	const buildPromptFromCurrentInputs = () => resolveAgentHarnessBeforePromptBuildResult({
-		prompt: prependCurrentTurnContext(promptText, params.currentTurnContext),
+		prompt: prependCurrentInboundContext(promptText, params.currentInboundContext),
 		developerInstructions,
 		messages: historyMessages,
 		ctx: hookContext
@@ -2693,11 +2693,12 @@ async function runCodexAppServerAttempt(params, options = {}) {
 			turnStartTimeoutMs: params.timeoutMs,
 			signal: runAbortController.signal
 		});
-		const threadConfig = mergeCodexThreadConfigs(nativeHookRelay ? buildCodexNativeHookRelayConfig({
+		const nativeHookRelayConfig = nativeHookRelay ? buildCodexNativeHookRelayConfig({
 			relay: nativeHookRelay,
 			events: nativeHookRelayEvents,
 			hookTimeoutSec: options.nativeHookRelay?.hookTimeoutSec
-		}) : options.nativeHookRelay?.enabled === false ? buildCodexNativeHookRelayDisabledConfig() : void 0, bundleMcpThreadConfig?.configPatch);
+		}) : options.nativeHookRelay?.enabled === false ? buildCodexNativeHookRelayDisabledConfig() : void 0;
+		const threadConfig = mergeCodexThreadConfigs(bundleMcpThreadConfig?.configPatch);
 		const pluginThreadConfigEnabled = shouldBuildCodexPluginThreadConfig(pluginConfig);
 		const pluginAppCacheKey = buildCodexPluginAppCacheKey({
 			appServer,
@@ -2740,6 +2741,7 @@ async function runCodexAppServerAttempt(params, options = {}) {
 						appServer: pluginAppServer,
 						developerInstructions: promptBuild.developerInstructions,
 						config: threadConfig,
+						finalConfigPatch: nativeHookRelayConfig,
 						mcpServersFingerprint: bundleMcpThreadConfig.fingerprint,
 						mcpServersFingerprintEvaluated: bundleMcpThreadConfig.evaluated,
 						contextEngineProjection,
@@ -2826,9 +2828,12 @@ async function runCodexAppServerAttempt(params, options = {}) {
 	let userInputBridge;
 	let steeringQueue;
 	let completed = false;
+	let terminalTurnNotificationQueued = false;
 	let timedOut = false;
 	let turnCompletionIdleTimedOut = false;
 	let turnCompletionIdleTimeoutMessage;
+	let clientClosedPromptError;
+	let clientClosedAbort = false;
 	let lifecycleStarted = false;
 	let lifecycleTerminalEmitted = false;
 	let resolveCompletion;
@@ -2842,6 +2847,7 @@ async function runCodexAppServerAttempt(params, options = {}) {
 	let turnCompletionIdleTimer;
 	let turnCompletionIdleWatchArmed = false;
 	let turnCompletionIdleWatchPinnedByTerminalError = false;
+	let turnCompletionIdleTimeoutOverrideMs;
 	let turnAssistantCompletionIdleTimer;
 	let turnAssistantCompletionIdleWatchArmed = false;
 	let turnAssistantCompletionLastActivityAt = Date.now();
@@ -2953,8 +2959,9 @@ async function runCodexAppServerAttempt(params, options = {}) {
 	};
 	const fireTurnCompletionIdleTimeout = () => {
 		if (completed || runAbortController.signal.aborted || !turnCompletionIdleWatchArmed || activeAppServerTurnRequests > 0) return;
+		const timeoutMs = turnCompletionIdleTimeoutOverrideMs ?? turnCompletionIdleTimeoutMs;
 		const idleMs = Math.max(0, Date.now() - turnCompletionLastActivityAt);
-		if (idleMs < turnCompletionIdleTimeoutMs) {
+		if (idleMs < timeoutMs) {
 			scheduleTurnCompletionIdleWatch();
 			return;
 		}
@@ -2966,7 +2973,7 @@ async function runCodexAppServerAttempt(params, options = {}) {
 			threadId: thread.threadId,
 			turnId,
 			idleMs,
-			timeoutMs: turnCompletionIdleTimeoutMs,
+			timeoutMs,
 			lastActivityReason: turnCompletionLastActivityReason,
 			...turnCompletionLastActivityDetails
 		});
@@ -2974,7 +2981,7 @@ async function runCodexAppServerAttempt(params, options = {}) {
 			threadId: thread.threadId,
 			turnId,
 			idleMs,
-			timeoutMs: turnCompletionIdleTimeoutMs,
+			timeoutMs,
 			lastActivityReason: turnCompletionLastActivityReason,
 			...turnCompletionLastActivityDetails
 		});
@@ -3013,7 +3020,7 @@ async function runCodexAppServerAttempt(params, options = {}) {
 		clearTurnCompletionIdleTimer();
 		if (completed || runAbortController.signal.aborted || !turnCompletionIdleWatchArmed || activeAppServerTurnRequests > 0) return;
 		const elapsedMs = Math.max(0, Date.now() - turnCompletionLastActivityAt);
-		const delayMs = Math.max(1, turnCompletionIdleTimeoutMs - elapsedMs);
+		const delayMs = Math.max(1, (turnCompletionIdleTimeoutOverrideMs ?? turnCompletionIdleTimeoutMs) - elapsedMs);
 		turnCompletionIdleTimer = setTimeout(fireTurnCompletionIdleTimeout, delayMs);
 		turnCompletionIdleTimer.unref?.();
 	}
@@ -3064,6 +3071,7 @@ async function runCodexAppServerAttempt(params, options = {}) {
 		turnCompletionLastActivityAt = Date.now();
 		turnCompletionLastActivityReason = reason;
 		turnCompletionLastActivityDetails = options?.details;
+		turnCompletionIdleTimeoutOverrideMs = void 0;
 		if (options?.attemptProgress) {
 			turnAttemptLastProgressAt = turnCompletionLastActivityAt;
 			turnAttemptLastProgressReason = reason;
@@ -3092,6 +3100,7 @@ async function runCodexAppServerAttempt(params, options = {}) {
 	const disarmTurnCompletionIdleWatch = () => {
 		turnCompletionIdleWatchArmed = false;
 		turnCompletionIdleWatchPinnedByTerminalError = false;
+		turnCompletionIdleTimeoutOverrideMs = void 0;
 		clearTurnCompletionIdleTimer();
 	};
 	const disarmTurnAssistantCompletionIdleWatch = () => {
@@ -3108,6 +3117,7 @@ async function runCodexAppServerAttempt(params, options = {}) {
 	const armTurnCompletionIdleWatch = (options) => {
 		turnCompletionIdleWatchArmed = true;
 		turnCompletionIdleWatchPinnedByTerminalError = options?.pinnedByTerminalError === true;
+		turnCompletionIdleTimeoutOverrideMs = options?.timeoutMs !== void 0 ? Math.max(1, Math.floor(options.timeoutMs)) : void 0;
 		scheduleTurnCompletionIdleWatch();
 	};
 	const emitLifecycleStart = () => {
@@ -3162,6 +3172,10 @@ async function runCodexAppServerAttempt(params, options = {}) {
 			itemId: item.id
 		});
 	};
+	const isTerminalTurnNotificationForTurn = (notification, notificationTurnId) => {
+		if (!isTurnNotification(notification.params, thread.threadId, notificationTurnId)) return false;
+		return notification.method === "turn/completed" || isCodexTurnAbortMarkerNotification(notification, { currentPromptText: promptBuild.prompt });
+	};
 	const handleNotification = async (notification) => {
 		userInputBridge?.handleNotification(notification);
 		if (!projector || !turnId) {
@@ -3183,6 +3197,7 @@ async function runCodexAppServerAttempt(params, options = {}) {
 		const rawToolOutputCompletion = isRawToolOutputCompletionNotification(notification);
 		if (isCurrentTurnNotification && (rawToolOutputCompletion || isNativeToolProgressNotification(notification))) turnCrossedToolHandoff = true;
 		const assistantCompletionCanRelease = isAssistantCompletionReleaseNotification(notification, turnCrossedToolHandoff);
+		const postToolRawAssistantCompletionNeedsTerminalGuard = isCurrentTurnNotification && turnCrossedToolHandoff && isRawAssistantCompletionNotification(notification) && activeTurnItemIds.size === 0;
 		const shouldRearmCompletionIdleWatchAfterLastCurrentTurnItem = isCurrentTurnNotification && notification.method === "item/completed" && activeTurnItemIds.size === 0 && !trackedDynamicToolCompletion && !assistantCompletionCanRelease;
 		if (isCurrentTurnNotification && notification.method === "error") {
 			if (isRetryableErrorNotification(notification.params)) disarmTurnCompletionIdleWatch();
@@ -3190,13 +3205,15 @@ async function runCodexAppServerAttempt(params, options = {}) {
 			disarmTurnAssistantCompletionIdleWatch();
 		} else if (isTurnCompletion) disarmTurnAssistantCompletionIdleWatch();
 		else if (isCurrentTurnNotification && assistantCompletionCanRelease) armTurnAssistantCompletionIdleWatch(describeNotificationActivity(notification));
+		else if (postToolRawAssistantCompletionNeedsTerminalGuard) armTurnCompletionIdleWatch({ timeoutMs: turnAssistantCompletionIdleTimeoutMs });
 		else if (unblockedAssistantCompletionRelease) armTurnAssistantCompletionIdleWatch(describeNotificationActivity(notification));
 		else if (shouldRearmCompletionIdleWatchAfterLastCurrentTurnItem) armTurnCompletionIdleWatch();
 		else if (isCurrentTurnNotification && rawToolOutputCompletion) armTurnCompletionIdleWatch();
 		else if (isCurrentTurnNotification && shouldDisarmAssistantCompletionIdleWatch(notification)) disarmTurnAssistantCompletionIdleWatch();
-		if (turnCompletionIdleWatchArmed && !turnCompletionIdleWatchPinnedByTerminalError && notification.method !== "turn/completed" && isCurrentTurnNotification && !trackedDynamicToolCompletion && !rawToolOutputCompletion && !shouldRearmCompletionIdleWatchAfterLastCurrentTurnItem) disarmTurnCompletionIdleWatch();
+		if (turnCompletionIdleWatchArmed && !turnCompletionIdleWatchPinnedByTerminalError && notification.method !== "turn/completed" && isCurrentTurnNotification && !trackedDynamicToolCompletion && !rawToolOutputCompletion && !postToolRawAssistantCompletionNeedsTerminalGuard && !shouldRearmCompletionIdleWatchAfterLastCurrentTurnItem) disarmTurnCompletionIdleWatch();
 		const isTurnAbortMarker = isCurrentTurnNotification && isCodexTurnAbortMarkerNotification(notification, { currentPromptText: promptBuild.prompt });
-		const isTurnTerminal = isTurnCompletion || isTurnAbortMarker;
+		const isTurnTerminal = isTerminalTurnNotificationForTurn(notification, turnId);
+		if (isTurnTerminal) terminalTurnNotificationQueued = true;
 		try {
 			await waitForCodexNotificationDispatchTurn();
 			await projector.handleNotification(notification);
@@ -3223,6 +3240,7 @@ async function runCodexAppServerAttempt(params, options = {}) {
 			pendingNotifications.push(notification);
 			return Promise.resolve();
 		}
+		if (isTerminalTurnNotificationForTurn(notification, turnId)) terminalTurnNotificationQueued = true;
 		notificationQueue = notificationQueue.then(() => handleNotification(notification), () => handleNotification(notification));
 		return notificationQueue;
 	};
@@ -3375,6 +3393,7 @@ async function runCodexAppServerAttempt(params, options = {}) {
 			} else scheduleTurnProgressWatches();
 		}
 	});
+	let closeCleanup;
 	const forceContextEngineCompactionForCodexOverflow = async (error) => {
 		if (!activeContextEngine?.info.ownsCompaction) return false;
 		embeddedAgentLog.warn("codex app-server context-engine turn overflowed; forcing context-engine compaction", {
@@ -3603,6 +3622,27 @@ async function runCodexAppServerAttempt(params, options = {}) {
 		imagesCount: params.images?.length ?? 0
 	});
 	projector = new CodexAppServerEventProjector(params, thread.threadId, activeTurnId, { nativePostToolUseRelayEnabled: nativeHookRelay?.allowedEvents.includes("post_tool_use") === true });
+	if (isTerminalTurnStatus(turn.turn.status) || pendingNotifications.some((notification) => isTerminalTurnNotificationForTurn(notification, activeTurnId))) terminalTurnNotificationQueued = true;
+	closeCleanup = client.addCloseHandler?.(() => {
+		if (completed || terminalTurnNotificationQueued || runAbortController.signal.aborted) return;
+		clientClosedPromptError = "codex app-server client closed before turn completed";
+		trajectoryRecorder?.recordEvent("turn.client_closed", {
+			threadId: thread.threadId,
+			turnId: activeTurnId
+		});
+		embeddedAgentLog.warn("codex app-server client closed before turn completed", {
+			threadId: thread.threadId,
+			turnId: activeTurnId
+		});
+		clientClosedAbort = true;
+		runAbortController.abort("client_closed");
+		completed = true;
+		clearTurnAttemptIdleTimer();
+		clearTurnCompletionIdleTimer();
+		clearTurnAssistantCompletionIdleTimer();
+		clearTurnTerminalIdleTimer();
+		resolveCompletion?.();
+	});
 	emitLifecycleStart();
 	const activeProjector = projector;
 	turnTerminalIdleWatchArmed = true;
@@ -3655,8 +3695,8 @@ async function runCodexAppServerAttempt(params, options = {}) {
 	try {
 		await completion;
 		const result = activeProjector.buildResult(toolBridge.telemetry, { yieldDetected });
-		const finalAborted = result.aborted || runAbortController.signal.aborted;
-		let finalPromptError = turnCompletionIdleTimedOut ? turnCompletionIdleTimeoutMessage : timedOut ? "codex app-server attempt timed out" : result.promptError;
+		const finalAborted = result.aborted || runAbortController.signal.aborted && !clientClosedAbort;
+		let finalPromptError = clientClosedPromptError ?? (turnCompletionIdleTimedOut ? turnCompletionIdleTimeoutMessage : timedOut ? "codex app-server attempt timed out" : result.promptError);
 		const finalPromptErrorMessage = typeof finalPromptError === "string" ? finalPromptError : finalPromptError ? formatErrorMessage(finalPromptError) : void 0;
 		if (shouldRefreshCodexRateLimitsForUsageLimitMessage(finalPromptErrorMessage)) finalPromptError = await refreshCodexUsageLimitErrorMessage({
 			client,
@@ -3668,7 +3708,7 @@ async function runCodexAppServerAttempt(params, options = {}) {
 			timeoutMs: appServer.requestTimeoutMs,
 			signal: runAbortController.signal
 		});
-		const finalPromptErrorSource = timedOut ? "prompt" : result.promptErrorSource;
+		const finalPromptErrorSource = timedOut || clientClosedPromptError ? "prompt" : result.promptErrorSource;
 		recordCodexTrajectoryCompletion(trajectoryRecorder, {
 			attempt: params,
 			result,
@@ -3774,11 +3814,11 @@ async function runCodexAppServerAttempt(params, options = {}) {
 			error: "codex app-server run completed without lifecycle terminal event"
 		});
 		if (trajectoryRecorder && !trajectoryEndRecorded) trajectoryRecorder.recordEvent("session.ended", {
-			status: timedOut || runAbortController.signal.aborted ? "interrupted" : "cleanup",
+			status: timedOut || runAbortController.signal.aborted && !clientClosedAbort ? "interrupted" : "cleanup",
 			threadId: thread.threadId,
 			turnId: activeTurnId,
 			timedOut,
-			aborted: runAbortController.signal.aborted
+			aborted: runAbortController.signal.aborted && !clientClosedAbort
 		});
 		await runAgentCleanupStep({
 			runId: params.runId,
@@ -3797,6 +3837,7 @@ async function runCodexAppServerAttempt(params, options = {}) {
 		clearTurnTerminalIdleTimer();
 		notificationCleanup();
 		requestCleanup();
+		closeCleanup?.();
 		nativeHookRelay?.unregister();
 		runAbortController.signal.removeEventListener("abort", abortListener);
 		params.abortSignal?.removeEventListener("abort", abortFromUpstream);
@@ -4692,7 +4733,7 @@ function codexExecutionToolName(item) {
 function joinPresentSections(...sections) {
 	return sections.filter((section) => Boolean(section?.trim())).join("\n\n");
 }
-function prependCurrentTurnContext(prompt, context) {
+function prependCurrentInboundContext(prompt, context) {
 	const text = context?.text.trim();
 	return text ? [text, prompt].filter(Boolean).join("\n\n") : prompt;
 }

package/dist/{session-binding-DbdVqMzW.js → session-binding-DqApZIgD.js}

@@ -1,5 +1,5 @@
 import { t as __exportAll } from "./rolldown-runtime-DUslC3ob.js";
-import { o as normalizeCodexServiceTier } from "./config-3ATInASk.js";
+import { o as normalizeCodexServiceTier } from "./config-B5pq6hEz.js";
 import { embeddedAgentLog } from "openclaw/plugin-sdk/agent-harness-runtime";
 import fs from "node:fs/promises";
 import { ensureAuthProfileStore, resolveDefaultAgentDir, resolveProviderIdForAuth } from "openclaw/plugin-sdk/agent-runtime";

package/dist/{shared-client-CnbrvEfV.js → shared-client-DlvmoLBJ.js}

@@ -1,6 +1,6 @@
 import { t as __exportAll } from "./rolldown-runtime-DUslC3ob.js";
-import { c as resolveCodexAppServerRuntimeOptions, n as codexAppServerStartOptionsKey } from "./config-3ATInASk.js";
-import { a as MANAGED_CODEX_APP_SERVER_PACKAGE, o as resolveCodexAppServerSpawnEnv, t as CodexAppServerClient } from "./client-CA7amCZ8.js";
+import { c as resolveCodexAppServerRuntimeOptions, n as codexAppServerStartOptionsKey } from "./config-B5pq6hEz.js";
+import { a as MANAGED_CODEX_APP_SERVER_PACKAGE, o as resolveCodexAppServerSpawnEnv, t as CodexAppServerClient } from "./client-6FkrXfaz.js";
 import { createRequire } from "node:module";
 import { createHash } from "node:crypto";
 import { constants, readFileSync } from "node:fs";
@@ -467,20 +467,39 @@ async function withTimeout$1(promise, timeoutMs, timeoutMessage) {
 //#endregion
 //#region extensions/codex/src/app-server/shared-client.ts
 var shared_client_exports = /* @__PURE__ */ __exportAll({
-	clearSharedCodexAppServerClient: () => clearSharedCodexAppServerClient,
 	clearSharedCodexAppServerClientAndWait: () => clearSharedCodexAppServerClientAndWait,
 	clearSharedCodexAppServerClientIfCurrent: () => clearSharedCodexAppServerClientIfCurrent,
+	clearSharedCodexAppServerClientIfCurrentAndWait: () => clearSharedCodexAppServerClientIfCurrentAndWait,
 	createIsolatedCodexAppServerClient: () => createIsolatedCodexAppServerClient,
 	getSharedCodexAppServerClient: () => getSharedCodexAppServerClient
 });
 const SHARED_CODEX_APP_SERVER_CLIENT_STATE = Symbol.for("openclaw.codexAppServerClientState");
 function getSharedCodexAppServerClientState() {
 	const globalState = globalThis;
-	globalState[SHARED_CODEX_APP_SERVER_CLIENT_STATE] ??= {};
-	return globalState[SHARED_CODEX_APP_SERVER_CLIENT_STATE];
+	const state = globalState[SHARED_CODEX_APP_SERVER_CLIENT_STATE];
+	if (isSharedCodexAppServerClientState(state)) return state;
+	const legacyState = readLegacySharedCodexAppServerClientState(state);
+	const clients = /* @__PURE__ */ new Map();
+	if (legacyState?.key && (legacyState.client || legacyState.promise)) {
+		const legacyKey = legacyState.key;
+		clients.set(legacyKey, {
+			client: legacyState.client,
+			promise: legacyState.promise
+		});
+		legacyState.client?.addCloseHandler((closedClient) => clearSharedClientEntryIfCurrent(legacyKey, closedClient));
+	}
+	const nextState = { clients };
+	globalState[SHARED_CODEX_APP_SERVER_CLIENT_STATE] = nextState;
+	return nextState;
+}
+function isSharedCodexAppServerClientState(value) {
+	return value !== null && typeof value === "object" && value.clients instanceof Map;
+}
+function readLegacySharedCodexAppServerClientState(value) {
+	if (value === null || typeof value !== "object") return;
+	return value;
 }
 async function getSharedCodexAppServerClient(options) {
-	const state = getSharedCodexAppServerClientState();
 	const agentDir = options?.agentDir ?? resolveDefaultAgentDir(options?.config ?? {});
 	const usesNativeAuth = options?.authProfileId === null;
 	const requestedAuthProfileId = options?.authProfileId === null ? void 0 : options?.authProfileId;
@@ -499,12 +518,12 @@ async function getSharedCodexAppServerClient(options) {
 		authProfileId,
 		agentDir: usesNativeAuth ? void 0 : agentDir
 	});
-	if (state.key && state.key !== key) clearSharedCodexAppServerClient();
-	state.key = key;
-	const sharedPromise = state.promise ?? (state.promise = (async () => {
+	const state = getSharedCodexAppServerClientState();
+	const entry = getOrCreateSharedClientEntry(state, key);
+	const sharedPromise = entry.promise ?? (entry.promise = (async () => {
 		const client = CodexAppServerClient.start(startOptions);
-		state.client = client;
-		client.addCloseHandler(clearSharedClientIfCurrent);
+		entry.client = client;
+		client.addCloseHandler((closedClient) => clearSharedClientEntryIfCurrent(key, closedClient));
 		try {
 			await client.initialize();
 			await applyCodexAppServerAuthProfile({
@@ -523,7 +542,8 @@ async function getSharedCodexAppServerClient(options) {
 	try {
 		return await withTimeout$1(sharedPromise, options?.timeoutMs ?? 0, "codex app-server initialize timed out");
 	} catch (error) {
-		if (state.promise === sharedPromise && state.key === key) clearSharedCodexAppServerClient();
+		const currentEntry = state.clients.get(key);
+		if (currentEntry?.promise === sharedPromise) clearSharedClientEntry(key, currentEntry);
 		throw error;
 	}
 }
@@ -560,38 +580,52 @@ async function createIsolatedCodexAppServerClient(options) {
 		throw error;
 	}
 }
-function clearSharedCodexAppServerClient() {
+function clearSharedCodexAppServerClientIfCurrent(client) {
+	if (!client) return false;
 	const state = getSharedCodexAppServerClientState();
-	const client = state.client;
-	state.client = void 0;
-	state.promise = void 0;
-	state.key = void 0;
-	client?.close();
+	for (const [key, entry] of state.clients) if (entry.client === client) {
+		state.clients.delete(key);
+		client.close();
+		return true;
+	}
+	return false;
 }
-function clearSharedCodexAppServerClientIfCurrent(client) {
+async function clearSharedCodexAppServerClientIfCurrentAndWait(client, options) {
 	if (!client) return false;
 	const state = getSharedCodexAppServerClientState();
-	if (state.client !== client) return false;
-	state.client = void 0;
-	state.promise = void 0;
-	state.key = void 0;
-	client.close();
-	return true;
+	for (const [key, entry] of state.clients) if (entry.client === client) {
+		state.clients.delete(key);
+		await client.closeAndWait(options);
+		return true;
+	}
+	return false;
 }
 async function clearSharedCodexAppServerClientAndWait(options) {
 	const state = getSharedCodexAppServerClientState();
-	const client = state.client;
-	state.client = void 0;
-	state.promise = void 0;
-	state.key = void 0;
-	await client?.closeAndWait(options);
+	const clients = collectSharedClients(state);
+	state.clients.clear();
+	await Promise.all(clients.map((client) => client.closeAndWait(options)));
+}
+function getOrCreateSharedClientEntry(state, key) {
+	let entry = state.clients.get(key);
+	if (!entry) {
+		entry = {};
+		state.clients.set(key, entry);
+	}
+	return entry;
+}
+function clearSharedClientEntry(key, entry) {
+	const state = getSharedCodexAppServerClientState();
+	if (state.clients.get(key) !== entry) return;
+	state.clients.delete(key);
+	entry.client?.close();
 }
-function clearSharedClientIfCurrent(client) {
+function clearSharedClientEntryIfCurrent(key, client) {
 	const state = getSharedCodexAppServerClientState();
-	if (state.client !== client) return;
-	state.client = void 0;
-	state.promise = void 0;
-	state.key = void 0;
+	if (state.clients.get(key)?.client === client) state.clients.delete(key);
+}
+function collectSharedClients(state) {
+	return [...new Set([...state.clients.values()].map((entry) => entry.client).filter((client) => Boolean(client)))];
 }
 //#endregion
-export { shared_client_exports as a, resolveCodexAppServerAuthAccountCacheKey as c, resolveCodexAppServerEnvApiKeyCacheKey as d, resolveCodexAppServerHomeDir as f, getSharedCodexAppServerClient as i, resolveCodexAppServerAuthProfileId as l, clearSharedCodexAppServerClientIfCurrent as n, withTimeout$1 as o, createIsolatedCodexAppServerClient as r, refreshCodexAppServerAuthTokens as s, clearSharedCodexAppServerClientAndWait as t, resolveCodexAppServerAuthProfileIdForAgent as u };
+export { shared_client_exports as a, resolveCodexAppServerAuthAccountCacheKey as c, resolveCodexAppServerEnvApiKeyCacheKey as d, resolveCodexAppServerHomeDir as f, getSharedCodexAppServerClient as i, resolveCodexAppServerAuthProfileId as l, clearSharedCodexAppServerClientIfCurrentAndWait as n, withTimeout$1 as o, createIsolatedCodexAppServerClient as r, refreshCodexAppServerAuthTokens as s, clearSharedCodexAppServerClientIfCurrent as t, resolveCodexAppServerAuthProfileIdForAgent as u };

package/dist/{side-question-D3nH-Jk1.js → side-question-BYYJZq23.js}

@@ -1,11 +1,11 @@
-import { c as resolveCodexAppServerRuntimeOptions, s as readCodexPluginConfig } from "./config-3ATInASk.js";
+import { c as resolveCodexAppServerRuntimeOptions, s as readCodexPluginConfig } from "./config-B5pq6hEz.js";
 import { a as readCodexDynamicToolCallParams, i as assertCodexTurnStartResponse, l as readCodexTurnCompletedNotification, t as assertCodexThreadForkResponse } from "./protocol-validators-BGBspNmF.js";
 import { t as isJsonObject } from "./protocol-C9UWI98H.js";
-import { r as isCodexAppServerApprovalRequest } from "./client-CA7amCZ8.js";
+import { r as isCodexAppServerApprovalRequest } from "./client-6FkrXfaz.js";
 import { u as formatCodexUsageLimitErrorMessage } from "./command-formatters-BRW7_Nu7.js";
-import { i as getSharedCodexAppServerClient, s as refreshCodexAppServerAuthTokens } from "./shared-client-CnbrvEfV.js";
-import { i as readCodexAppServerBinding } from "./session-binding-DbdVqMzW.js";
-import { b as createCodexDynamicToolBridge, d as resolveReasoningEffort, n as buildCodexRuntimeThreadConfig, u as resolveCodexAppServerModelProvider, x as filterCodexDynamicTools } from "./thread-lifecycle-D2sxRPdz.js";
+import { i as getSharedCodexAppServerClient, s as refreshCodexAppServerAuthTokens } from "./shared-client-DlvmoLBJ.js";
+import { i as readCodexAppServerBinding } from "./session-binding-DqApZIgD.js";
+import { b as createCodexDynamicToolBridge, d as resolveReasoningEffort, n as buildCodexRuntimeThreadConfig, u as resolveCodexAppServerModelProvider, x as filterCodexDynamicTools } from "./thread-lifecycle-wcyYqwrl.js";
 import { n as handleCodexAppServerElicitationRequest, r as handleCodexAppServerApprovalRequest, t as filterToolsForVisionInputs } from "./vision-tools-Cm_YicZb.js";
 import { n as rememberCodexRateLimits, t as readRecentCodexRateLimits } from "./rate-limit-cache-dvhq-4pi.js";
 import { embeddedAgentLog, formatErrorMessage, resolveAgentDir, resolveAttemptSpawnWorkspaceDir, resolveModelAuthMode, resolveSandboxContext, resolveSessionAgentIds, supportsModelTools } from "openclaw/plugin-sdk/agent-harness-runtime";

package/dist/test-api.js

@@ -1,5 +1,5 @@
-import { c as resolveCodexAppServerRuntimeOptions } from "./config-3ATInASk.js";
-import { a as buildThreadResumeParams, b as createCodexDynamicToolBridge, i as buildDeveloperInstructions, o as buildThreadStartParams, s as buildTurnStartParams, x as filterCodexDynamicTools } from "./thread-lifecycle-D2sxRPdz.js";
+import { c as resolveCodexAppServerRuntimeOptions } from "./config-B5pq6hEz.js";
+import { a as buildThreadResumeParams, b as createCodexDynamicToolBridge, i as buildDeveloperInstructions, o as buildThreadStartParams, s as buildTurnStartParams, x as filterCodexDynamicTools } from "./thread-lifecycle-wcyYqwrl.js";
 //#region extensions/codex/test-api.ts
 function resolveCodexPromptSnapshotAppServerOptions(pluginConfig) {
 	return resolveCodexAppServerRuntimeOptions({

package/dist/{thread-lifecycle-D2sxRPdz.js → thread-lifecycle-wcyYqwrl.js}

@@ -1,11 +1,11 @@
-import { r as codexSandboxPolicyForTurn, u as resolveCodexPluginsPolicy } from "./config-3ATInASk.js";
+import { r as codexSandboxPolicyForTurn, u as resolveCodexPluginsPolicy } from "./config-B5pq6hEz.js";
 import { n as assertCodexThreadResumeResponse, r as assertCodexThreadStartResponse } from "./protocol-validators-BGBspNmF.js";
 import { t as isJsonObject } from "./protocol-C9UWI98H.js";
 import { CODEX_GPT5_HEARTBEAT_PROMPT_OVERLAY, renderCodexPromptOverlay } from "./prompt-overlay.js";
 import { isModernCodexModel } from "./provider.js";
-import { i as isCodexAppServerConnectionClosedError } from "./client-CA7amCZ8.js";
-import { i as readCodexAppServerBinding, n as isCodexAppServerNativeAuthProfile, o as writeCodexAppServerBinding, t as clearCodexAppServerBinding } from "./session-binding-DbdVqMzW.js";
-import { a as defaultCodexAppInventoryCache, r as readCodexPluginInventory, t as ensureCodexPluginActivation } from "./plugin-activation-BDU4e-NA.js";
+import { i as isCodexAppServerConnectionClosedError } from "./client-6FkrXfaz.js";
+import { i as readCodexAppServerBinding, n as isCodexAppServerNativeAuthProfile, o as writeCodexAppServerBinding, t as clearCodexAppServerBinding } from "./session-binding-DqApZIgD.js";
+import { a as defaultCodexAppInventoryCache, r as readCodexPluginInventory, t as ensureCodexPluginActivation } from "./plugin-activation-B49xb7pI.js";
 import crypto from "node:crypto";
 import { HEARTBEAT_RESPONSE_TOOL_NAME, createAgentToolResultMiddlewareRunner, createCodexAppServerToolResultExtensionRunner, embeddedAgentLog, extractToolResultMediaArtifact, filterToolResultMediaUrls, isActiveHarnessContextEngine, isMessagingTool, isMessagingToolSendAction, isToolWrappedWithBeforeToolCallHook, normalizeHeartbeatToolResponse, runAgentHarnessAfterToolCallHook, wrapToolWithBeforeToolCallHook } from "openclaw/plugin-sdk/agent-harness-runtime";
 import { buildCodexUserMcpServersThreadConfigPatch } from "openclaw/plugin-sdk/codex-mcp-projection";
@@ -872,7 +872,7 @@ async function startOrResumeThread(params) {
 		}
 	} else try {
 		const authProfileId = params.params.authProfileId ?? binding.authProfileId;
-		const resumeConfig = mergeCodexThreadConfigs(params.config, userMcpServersConfigPatch);
+		const resumeConfig = mergeCodexThreadConfigs(params.config, userMcpServersConfigPatch, params.finalConfigPatch);
 		const response = assertCodexThreadResumeResponse(await params.client.request("thread/resume", buildThreadResumeParams(params.params, {
 			threadId: binding.threadId,
 			authProfileId,
@@ -939,7 +939,7 @@ async function startOrResumeThread(params) {
 		await clearCodexAppServerBinding(params.params.sessionFile);
 	}
 	const pluginThreadConfig = params.pluginThreadConfig?.enabled ? prebuiltPluginThreadConfig ?? await params.pluginThreadConfig.build() : void 0;
-	const config = mergeCodexThreadConfigs(params.config, userMcpServersConfigPatch, pluginThreadConfig?.configPatch);
+	const config = mergeCodexThreadConfigs(params.config, userMcpServersConfigPatch, pluginThreadConfig?.configPatch, params.finalConfigPatch);
 	const response = assertCodexThreadStartResponse(await params.client.request("thread/start", buildThreadStartParams(params.params, {
 		cwd: params.cwd,
 		dynamicTools: params.dynamicTools,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openclaw/codex",
-  "version": "2026.5.16-beta.3",
+  "version": "2026.5.16-beta.4",
   "description": "OpenClaw Codex harness and model provider plugin",
   "repository": {
     "type": "git",
@@ -27,10 +27,10 @@
       "minHostVersion": ">=2026.5.1-beta.1"
     },
     "compat": {
-      "pluginApi": ">=2026.5.16-beta.3"
+      "pluginApi": ">=2026.5.16-beta.4"
     },
     "build": {
-      "openclawVersion": "2026.5.16-beta.3"
+      "openclawVersion": "2026.5.16-beta.4"
     },
     "release": {
       "publishToClawHub": true,
@@ -45,7 +45,7 @@
     "openclaw.plugin.json"
   ],
   "peerDependencies": {
-    "openclaw": ">=2026.5.16-beta.3"
+    "openclaw": ">=2026.5.16-beta.4"
   },
   "peerDependenciesMeta": {
     "openclaw": {