@openclaw/codex 2026.5.25-beta.1 → 2026.5.26-beta.1

package/dist/{run-attempt-BjoI3hUJ.js → run-attempt-CFBsGx1T.js}

@@ -1,19 +1,19 @@
-import { t as defaultCodexAppServerClientFactory } from "./client-factory-A7DQkSLq.js";
-import { c as readCodexPluginConfig, d as resolveCodexPluginsPolicy, f as shouldAutoApproveCodexAppServerApprovals, i as isCodexAppServerApprovalPolicyAllowedByRequirements, l as resolveCodexAppServerRuntimeOptions, o as isCodexSandboxExecServerEnabled, p as withMcpElicitationsApprovalPolicy, u as resolveCodexComputerUseConfig } from "./config-D6TUuyo2.js";
-import { a as readCodexDynamicToolCallParams, c as readCodexTurn, i as assertCodexTurnStartResponse } from "./protocol-validators-_gKDcd0x.js";
-import { a as isCodexAppServerConnectionClosedError, i as isCodexAppServerApprovalRequest, l as isJsonObject, r as compareCodexAppServerVersions, s as MIN_CODEX_SANDBOX_EXEC_SERVER_APP_SERVER_VERSION } from "./client-SrtuTTVa.js";
-import { D as resolveCodexContextEngineProjectionMaxChars, E as projectContextEngineAssemblyForCodex, O as resolveCodexContextEngineProjectionReserveTokens, S as defaultCodexAppInventoryCache, _ as mergeCodexThreadConfigs, a as buildDeveloperInstructions, c as buildTurnCollaborationMode, d as isContextEngineBindingCompatible, g as buildCodexPluginThreadConfigInputFingerprint, h as buildCodexPluginThreadConfig, i as buildContextEngineBinding, l as buildTurnStartParams, m as startOrResumeThread, n as areCodexDynamicToolFingerprintsCompatible, u as codexDynamicToolsFingerprint, v as shouldBuildCodexPluginThreadConfig, w as sanitizeCodexHistoryImagePayloads } from "./thread-lifecycle-CXMd9UgJ.js";
-import { i as readCodexAppServerBinding, t as clearCodexAppServerBinding } from "./session-binding-CwNOIDP2.js";
-import { n as buildCodexPluginAppCacheKey, r as CODEX_CONTROL_METHODS } from "./request-BO0z3vA8.js";
-import { g as shouldRefreshCodexRateLimitsForUsageLimitMessage, h as resolveCodexUsageLimitResetAtMs, i as readCodexNotificationTurnId, m as formatCodexUsageLimitErrorMessage, n as isCodexNotificationForTurn, r as readCodexNotificationThreadId, s as formatCodexDisplayText, t as describeCodexNotificationCorrelation } from "./notification-correlation-D7tJW3FW.js";
-import { c as resolveCodexAppServerAuthAccountCacheKey, d as resolveCodexAppServerEnvApiKeyCacheKey, f as resolveCodexAppServerHomeDir, l as resolveCodexAppServerAuthProfileId, s as refreshCodexAppServerAuthTokens, t as clearSharedCodexAppServerClientIfCurrent, u as resolveCodexAppServerAuthProfileIdForAgent } from "./shared-client-CZP1DjaN.js";
+import { t as defaultCodexAppServerClientFactory } from "./client-factory-CaOpX89B.js";
+import { c as readCodexPluginConfig, d as resolveCodexPluginsPolicy, f as shouldAutoApproveCodexAppServerApprovals, i as isCodexAppServerApprovalPolicyAllowedByRequirements, l as resolveCodexAppServerRuntimeOptions, o as isCodexSandboxExecServerEnabled, p as withMcpElicitationsApprovalPolicy, u as resolveCodexComputerUseConfig } from "./config-0-UN67Qg.js";
+import { a as readCodexDynamicToolCallParams, c as readCodexTurn, i as assertCodexTurnStartResponse } from "./protocol-validators-CSuFMLvY.js";
+import { a as isCodexAppServerConnectionClosedError, i as isCodexAppServerApprovalRequest, l as isJsonObject, r as compareCodexAppServerVersions, s as MIN_CODEX_SANDBOX_EXEC_SERVER_APP_SERVER_VERSION } from "./client-BVK_jmHW.js";
+import { C as defaultCodexAppInventoryCache, D as projectContextEngineAssemblyForCodex, O as resolveCodexContextEngineProjectionMaxChars, T as sanitizeCodexHistoryImagePayloads, _ as buildCodexPluginThreadConfigInputFingerprint, a as buildDeveloperInstructions, c as buildTurnCollaborationMode, d as isContextEngineBindingCompatible, g as buildCodexPluginThreadConfig, h as isCodexAppServerProfilerEnabled, i as buildContextEngineBinding, k as resolveCodexContextEngineProjectionReserveTokens, l as buildTurnStartParams, m as startOrResumeThread, n as areCodexDynamicToolFingerprintsCompatible, u as codexDynamicToolsFingerprint, v as mergeCodexThreadConfigs, y as shouldBuildCodexPluginThreadConfig } from "./thread-lifecycle-BapIT9Qs.js";
+import { i as readCodexAppServerBinding, t as clearCodexAppServerBinding } from "./session-binding-UFjjws4k.js";
+import { n as buildCodexPluginAppCacheKey, r as CODEX_CONTROL_METHODS } from "./request-DmBkYLPy.js";
+import { g as shouldRefreshCodexRateLimitsForUsageLimitMessage, h as resolveCodexUsageLimitResetAtMs, i as readCodexNotificationTurnId, m as formatCodexUsageLimitErrorMessage, n as isCodexNotificationForTurn, r as readCodexNotificationThreadId, s as formatCodexDisplayText, t as describeCodexNotificationCorrelation } from "./notification-correlation-YINts3PA.js";
+import { c as resolveCodexAppServerAuthAccountCacheKey, d as resolveCodexAppServerFallbackApiKeyCacheKey, f as resolveCodexAppServerHomeDir, l as resolveCodexAppServerAuthProfileId, s as refreshCodexAppServerAuthTokens, t as clearSharedCodexAppServerClientIfCurrent, u as resolveCodexAppServerAuthProfileIdForAgent } from "./shared-client-Fou5nAyt.js";
 import { i as resolveCodexNativeExecutionPolicy } from "./sandbox-guard-CTnEWuor.js";
-import { a as resolveCodexDynamicToolsLoading, i as normalizeCodexDynamicToolName, n as filterCodexDynamicTools, r as isForcedPrivateQaCodexRuntime, t as createCodexDynamicToolBridge } from "./dynamic-tools-BXAE1U1-.js";
-import { a as handleCodexAppServerElicitationRequest, c as emitDynamicToolTerminalDiagnostic, i as buildCodexNativeHookRelayDisabledConfig, l as handleCodexAppServerApprovalRequest, n as CODEX_NATIVE_HOOK_RELAY_EVENTS, o as emitDynamicToolErrorDiagnostic, r as buildCodexNativeHookRelayConfig, s as emitDynamicToolStartedDiagnostic, t as filterToolsForVisionInputs } from "./vision-tools-CETeQgze.js";
-import { t as ensureCodexComputerUse } from "./computer-use-CVfE2Vfb.js";
+import { a as resolveCodexDynamicToolsLoading, i as normalizeCodexDynamicToolName, n as filterCodexDynamicTools, r as isForcedPrivateQaCodexRuntime, t as createCodexDynamicToolBridge } from "./dynamic-tools-BG9ICyU4.js";
+import { a as handleCodexAppServerElicitationRequest, c as emitDynamicToolTerminalDiagnostic, i as buildCodexNativeHookRelayDisabledConfig, l as handleCodexAppServerApprovalRequest, n as CODEX_NATIVE_HOOK_RELAY_EVENTS, o as emitDynamicToolErrorDiagnostic, r as buildCodexNativeHookRelayConfig, s as emitDynamicToolStartedDiagnostic, t as filterToolsForVisionInputs } from "./vision-tools-B30YCKRK.js";
+import { t as ensureCodexComputerUse } from "./computer-use-CDDlIBhY.js";
 import { n as rememberCodexRateLimits, t as readRecentCodexRateLimits } from "./rate-limit-cache-N66I-Rd7.js";
 import { createHash, randomUUID } from "node:crypto";
-import nodeFs from "node:fs";
+import fsSync from "node:fs";
 import { asBoolean, asFiniteNumber, normalizeOptionalString, normalizeStringEntries } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { CODEX_APP_SERVER_CONTEXT_ENGINE_HOST, TOOL_PROGRESS_OUTPUT_MAX_CHARS, acquireSessionWriteLock, appendSessionTranscriptMessage, assembleHarnessContextEngine, assertContextEngineHostSupport, awaitAgentHarnessAgentEndHook, bootstrapHarnessContextEngine, buildAgentHookContextChannelFields, buildEmbeddedAttemptToolRunContext, buildHarnessContextEngineRuntimeContext, buildHarnessContextEngineRuntimeContextFromUsage, classifyAgentHarnessTerminalOutcome, clearActiveEmbeddedRun, embeddedAgentLog, emitAgentEvent, emitSessionTranscriptUpdate, finalizeHarnessContextEngineTurn, formatErrorMessage, formatToolAggregate, formatToolProgressOutput, getBeforeToolCallPolicyDiagnosticState, inferToolMetaFromArgs, isActiveHarnessContextEngine, isSubagentSessionKey, loadCodexBundleMcpThreadConfig, normalizeAgentRuntimeTools, normalizeUsage, registerNativeHookRelay, resolveAgentHarnessBeforePromptBuildResult, resolveAttemptSpawnWorkspaceDir, resolveBootstrapContextForRun, resolveContextEngineOwnerPluginId, resolveModelAuthMode, resolveSandboxContext, resolveSessionAgentIds, resolveSessionWriteLockOptions, resolveUserPath, runAgentCleanupStep, runAgentHarnessAfterCompactionHook, runAgentHarnessAfterToolCallHook, runAgentHarnessAgentEndHook, runAgentHarnessBeforeCompactionHook, runAgentHarnessBeforeMessageWriteHook, runAgentHarnessLlmInputHook, runAgentHarnessLlmOutputHook, runHarnessContextEngineMaintenance, setActiveEmbeddedRun, supportsModelTools } from "openclaw/plugin-sdk/agent-harness-runtime";
 import { spawn } from "node:child_process";
@@ -22,10 +22,10 @@ import { WebSocketServer } from "ws";
 import { redactSensitiveFieldValue, redactToolPayloadText } from "openclaw/plugin-sdk/logging-core";
 import fs from "node:fs/promises";
 import path, { posix } from "node:path";
+import { createDiagnosticTraceContextFromActiveScope, emitTrustedDiagnosticEvent, emitTrustedDiagnosticEventWithPrivateData, freezeDiagnosticTraceContext, hasPendingInternalDiagnosticEvent, onInternalDiagnosticEvent, resolveDiagnosticModelContentCapturePolicy } from "openclaw/plugin-sdk/diagnostic-runtime";
 import { markAuthProfileBlockedUntil, resolveAgentDir as resolveAgentDir$1 } from "openclaw/plugin-sdk/agent-runtime";
 import { isToolAllowed } from "openclaw/plugin-sdk/sandbox";
 import { appendRegularFile, pathExists } from "openclaw/plugin-sdk/security-runtime";
-import { createDiagnosticTraceContextFromActiveScope, emitTrustedDiagnosticEvent, emitTrustedDiagnosticEventWithPrivateData, freezeDiagnosticTraceContext, hasPendingInternalDiagnosticEvent, onInternalDiagnosticEvent, resolveDiagnosticModelContentCapturePolicy } from "openclaw/plugin-sdk/diagnostic-runtime";
 import { buildSessionContext, migrateSessionEntries, parseSessionEntries } from "@earendil-works/pi-coding-agent";
 import { createAgentHarnessTaskRuntime, deliverAgentHarnessTaskCompletion, isDurableAgentHarnessCompletionDelivery } from "openclaw/plugin-sdk/agent-harness-task-runtime";
 import { isIP } from "node:net";
@@ -3946,7 +3946,7 @@ const JWT_VALUE_RE = /\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]
 const COOKIE_PAIR_RE = /\b([A-Za-z][A-Za-z0-9_.-]{1,64})=([A-Za-z0-9+/._~%=-]{16,})(?=;|\s|$)/gu;
 const TRAJECTORY_RUNTIME_FILE_MAX_BYTES = 50 * 1024 * 1024;
 const TRAJECTORY_RUNTIME_EVENT_MAX_BYTES = 256 * 1024;
-function resolveCodexTrajectoryPointerFlags(constants = nodeFs.constants) {
+function resolveCodexTrajectoryPointerFlags(constants = fsSync.constants) {
 	const noFollow = constants.O_NOFOLLOW;
 	return constants.O_CREAT | constants.O_TRUNC | constants.O_WRONLY | (typeof noFollow === "number" ? noFollow : 0);
 }
@@ -3980,23 +3980,23 @@ function writeTrajectoryPointerBestEffort(params) {
 	const pointerPath = resolveTrajectoryPointerFilePath(params.sessionFile);
 	try {
 		const pointerDir = path.resolve(path.dirname(pointerPath));
-		if (nodeFs.lstatSync(pointerDir).isSymbolicLink()) return;
+		if (fsSync.lstatSync(pointerDir).isSymbolicLink()) return;
 		try {
-			if (nodeFs.lstatSync(pointerPath).isSymbolicLink()) return;
+			if (fsSync.lstatSync(pointerPath).isSymbolicLink()) return;
 		} catch (error) {
 			if (error.code !== "ENOENT") return;
 		}
-		const fd = nodeFs.openSync(pointerPath, resolveCodexTrajectoryPointerFlags(), 384);
+		const fd = fsSync.openSync(pointerPath, resolveCodexTrajectoryPointerFlags(), 384);
 		try {
-			nodeFs.writeFileSync(fd, `${JSON.stringify({
+			fsSync.writeFileSync(fd, `${JSON.stringify({
 				traceSchema: "openclaw-trajectory-pointer",
 				schemaVersion: 1,
 				sessionId: params.sessionId,
 				runtimeFile: params.filePath
 			}, null, 2)}\n`, "utf8");
-			nodeFs.fchmodSync(fd, 384);
+			fsSync.fchmodSync(fd, 384);
 		} finally {
-			nodeFs.closeSync(fd);
+			fsSync.closeSync(fd);
 		}
 	} catch {}
 }
@@ -4361,6 +4361,7 @@ const CODEX_BOOTSTRAP_CONTEXT_ORDER = new Map([
 	["memory.md", 60],
 	["heartbeat.md", 70]
 ]);
+const ensuredCodexWorkspaceDirs = /* @__PURE__ */ new Set();
 const pendingCodexNativeHookRelayUnregisters = /* @__PURE__ */ new Set();
 function scheduleCodexNativeHookRelayUnregister(params) {
 	let pending;
@@ -4383,6 +4384,19 @@ function resolveCodexNativeHookRelayUnregisterGraceMs(hookTimeoutSec) {
 	const hookTimeoutMs = typeof hookTimeoutSec === "number" && Number.isFinite(hookTimeoutSec) && hookTimeoutSec > 0 ? Math.ceil(hookTimeoutSec) * 1e3 : 0;
 	return Math.max(CODEX_NATIVE_HOOK_RELAY_UNREGISTER_GRACE_MS, hookTimeoutMs + CODEX_NATIVE_HOOK_RELAY_UNREGISTER_EXTRA_GRACE_MS);
 }
+async function ensureCodexWorkspaceDirOnce(workspaceDir) {
+	const normalized = path.resolve(workspaceDir);
+	if (ensuredCodexWorkspaceDirs.has(normalized)) {
+		try {
+			if ((await fs.stat(normalized)).isDirectory()) return;
+		} catch (error) {
+			if ((typeof error === "object" && error ? error.code : void 0) !== "ENOENT") throw error;
+		}
+		ensuredCodexWorkspaceDirs.delete(normalized);
+	}
+	await fs.mkdir(normalized, { recursive: true });
+	ensuredCodexWorkspaceDirs.add(normalized);
+}
 function emitCodexAppServerEvent(params, event) {
 	try {
 		emitAgentEvent({
@@ -4565,7 +4579,7 @@ function isCodexAppServerPolicyMode(value) {
 function isCodexAppServerApprovalPolicy(value) {
 	return value === "never" || value === "on-request" || value === "on-failure" || value === "untrusted";
 }
-const CODEX_APP_SERVER_NATIVE_THREAD_MAX_TOKENS = 7e4;
+const CODEX_APP_SERVER_NATIVE_THREAD_FALLBACK_MAX_TOKENS = 3e5;
 const CODEX_APP_SERVER_BYTE_UNITS = {
 	b: 1,
 	k: 1024,
@@ -4653,25 +4667,29 @@ async function readCodexSessionRecordForSessionFile(sessionFile) {
 		};
 	}
 }
-async function readCodexAppServerRolloutTokenUsage(file) {
+async function readCodexAppServerRolloutTokenSnapshot(file) {
 	let handle;
 	try {
 		handle = await fs.open(file, "r");
 	} catch {
 		return;
 	}
-	let totalTokens;
+	let snapshot;
 	try {
 		for await (const line of handle.readLines()) {
-			const lineTokens = readCodexAppServerRolloutTokenUsageLine(line);
-			if (lineTokens !== void 0) totalTokens = lineTokens;
+			const lineSnapshot = readCodexAppServerRolloutTokenSnapshotLine(line);
+			if (lineSnapshot !== void 0) {
+				snapshot ??= {};
+				if (lineSnapshot.totalTokens !== void 0) snapshot.totalTokens = lineSnapshot.totalTokens;
+				if (lineSnapshot.modelContextWindow !== void 0) snapshot.modelContextWindow = lineSnapshot.modelContextWindow;
+			}
 		}
 	} finally {
 		await handle.close();
 	}
-	return totalTokens;
+	return snapshot;
 }
-function readCodexAppServerRolloutTokenUsageLine(line) {
+function readCodexAppServerRolloutTokenSnapshotLine(line) {
 	if (!line.trim()) return;
 	try {
 		const parsed = JSON.parse(line);
@@ -4680,11 +4698,20 @@ function readCodexAppServerRolloutTokenUsageLine(line) {
 		if (!info) return;
 		const usage = isJsonObject(info.last_token_usage) ? info.last_token_usage : isJsonObject(info.total_token_usage) ? info.total_token_usage : void 0;
 		const value = usage?.total_tokens ?? usage?.totalTokens;
-		return typeof value === "number" && Number.isFinite(value) ? value : void 0;
+		const totalTokens = typeof value === "number" && Number.isFinite(value) ? value : void 0;
+		const windowValue = info.model_context_window ?? info.modelContextWindow;
+		const modelContextWindow = typeof windowValue === "number" && Number.isFinite(windowValue) && windowValue > 0 ? Math.floor(windowValue) : void 0;
+		const snapshot = {};
+		if (totalTokens !== void 0) snapshot.totalTokens = totalTokens;
+		if (modelContextWindow !== void 0) snapshot.modelContextWindow = modelContextWindow;
+		return snapshot.totalTokens !== void 0 || snapshot.modelContextWindow !== void 0 ? snapshot : void 0;
 	} catch {
 		return;
 	}
 }
+function resolveCodexAppServerNativeThreadTokenFuse(modelContextWindow) {
+	return modelContextWindow ?? CODEX_APP_SERVER_NATIVE_THREAD_FALLBACK_MAX_TOKENS;
+}
 function utf8JsonByteLength(value) {
 	try {
 		return Buffer.byteLength(JSON.stringify(value), "utf8");
@@ -4697,10 +4724,22 @@ function maxFiniteNumber(values) {
 	if (nums.length === 0) return;
 	return Math.max(...nums);
 }
+function hasContextEngineThreadBootstrapProjection(binding) {
+	return binding.contextEngine?.projection?.mode === "thread_bootstrap";
+}
 async function rotateOversizedCodexAppServerStartupBinding(params) {
 	const binding = params.binding;
 	if (!binding?.threadId) return binding;
 	if (params.config?.agents?.defaults?.compaction?.truncateAfterCompaction !== true) return binding;
+	if (params.contextEngineActive === true && hasContextEngineThreadBootstrapProjection(binding)) {
+		embeddedAgentLog.debug("codex app-server deferring native transcript size guard for context-engine thread bootstrap", {
+			threadId: binding.threadId,
+			engineId: binding.contextEngine?.engineId,
+			epoch: binding.contextEngine?.projection?.epoch,
+			fingerprint: binding.contextEngine?.projection?.fingerprint
+		});
+		return binding;
+	}
 	const sessionRecord = await readCodexSessionRecordForSessionFile(params.sessionFile);
 	const maxBytes = parseCodexAppServerByteLimit(params.config?.agents?.defaults?.compaction?.maxActiveTranscriptBytes);
 	const rolloutFiles = await listCodexAppServerRolloutFilesForThread(params.agentDir, binding.threadId, params.codexHome);
@@ -4719,16 +4758,20 @@ async function rotateOversizedCodexAppServerStartupBinding(params) {
 			return;
 		}
 	}
-	const nativeTokens = maxFiniteNumber(await Promise.all(rolloutFiles.map(async (file) => readCodexAppServerRolloutTokenUsage(file.path))));
+	const nativeTokenSnapshots = await Promise.all(rolloutFiles.map(async (file) => readCodexAppServerRolloutTokenSnapshot(file.path)));
+	const nativeTokens = maxFiniteNumber(nativeTokenSnapshots.map((snapshot) => snapshot?.totalTokens));
+	const nativeModelContextWindow = maxFiniteNumber(nativeTokenSnapshots.map((snapshot) => snapshot?.modelContextWindow));
+	const maxTokens = resolveCodexAppServerNativeThreadTokenFuse(nativeModelContextWindow);
 	const sessionTokens = sessionRecord?.totalTokensFresh !== false && typeof sessionRecord?.totalTokens === "number" && Number.isFinite(sessionRecord.totalTokens) ? sessionRecord.totalTokens : void 0;
 	const tokenCount = maxFiniteNumber([sessionTokens, nativeTokens]);
-	if (tokenCount !== void 0 && tokenCount >= CODEX_APP_SERVER_NATIVE_THREAD_MAX_TOKENS) {
+	if (tokenCount !== void 0 && tokenCount >= maxTokens) {
 		embeddedAgentLog.warn("codex app-server native transcript exceeded active token limit; starting a fresh thread", {
 			threadId: binding.threadId,
-			maxTokens: CODEX_APP_SERVER_NATIVE_THREAD_MAX_TOKENS,
+			maxTokens,
 			sessionKey: sessionRecord?.sessionKey,
 			sessionTokens,
-			nativeTokens
+			nativeTokens,
+			nativeModelContextWindow
 		});
 		await clearCodexAppServerBinding(params.sessionFile);
 		return;
@@ -4747,6 +4790,7 @@ async function runCodexAgentEndHook(params, hookParams) {
 }
 async function runCodexAppServerAttempt(params, options = {}) {
 	const attemptStartedAt = Date.now();
+	const profilerEnabled = isCodexAppServerProfilerEnabled(params.config);
 	const codexModelCallTrace = freezeDiagnosticTraceContext(createDiagnosticTraceContextFromActiveScope());
 	const codexModelContentCapture = resolveDiagnosticModelContentCapturePolicy(params.config);
 	const codexModelCallId = `${params.runId}:codex-model:1`;
@@ -4754,13 +4798,16 @@ async function runCodexAppServerAttempt(params, options = {}) {
 	let codexModelCallStarted = false;
 	let codexModelCallTerminalEmitted = false;
 	let codexModelCallRequestPayloadBytes;
+	const preDynamicStartupStages = createCodexDynamicToolBuildStageTracker({ enabled: profilerEnabled });
 	const attemptClientFactory = options.clientFactory ?? defaultCodexAppServerClientFactory;
 	const pluginConfig = readCodexPluginConfig(options.pluginConfig);
 	const computerUseConfig = resolveCodexComputerUseConfig({ pluginConfig });
 	const configuredAppServer = resolveCodexAppServerRuntimeOptions({ pluginConfig });
 	const beforeToolCallPolicy = getBeforeToolCallPolicyDiagnosticState();
+	preDynamicStartupStages.mark("config");
 	const resolvedWorkspace = resolveUserPath(params.workspaceDir);
-	await fs.mkdir(resolvedWorkspace, { recursive: true });
+	await ensureCodexWorkspaceDirOnce(resolvedWorkspace);
+	preDynamicStartupStages.mark("workspace");
 	const sandboxSessionKey = params.sandboxSessionKey?.trim() || params.sessionKey?.trim() || params.sessionId;
 	const contextSessionKey = params.sessionKey?.trim() || sandboxSessionKey;
 	const sandbox = await resolveSandboxContext({
@@ -4768,8 +4815,10 @@ async function runCodexAppServerAttempt(params, options = {}) {
 		sessionKey: sandboxSessionKey,
 		workspaceDir: resolvedWorkspace
 	});
+	preDynamicStartupStages.mark("sandbox");
 	const effectiveWorkspace = sandbox?.enabled ? sandbox.workspaceAccess === "rw" ? resolvedWorkspace : sandbox.workspaceDir : resolvedWorkspace;
-	await fs.mkdir(effectiveWorkspace, { recursive: true });
+	await ensureCodexWorkspaceDirOnce(effectiveWorkspace);
+	preDynamicStartupStages.mark("effective-workspace");
 	const appServer = resolveCodexAppServerForOpenClawToolPolicy({
 		appServer: configuredAppServer,
 		pluginConfig,
@@ -4783,11 +4832,13 @@ async function runCodexAppServerAttempt(params, options = {}) {
 		beforeToolCallHook: beforeToolCallPolicy.hasBeforeToolCallHook,
 		trustedToolPolicies: beforeToolCallPolicy.trustedToolPolicies
 	});
+	preDynamicStartupStages.mark("app-server-policy");
 	let pluginAppServer = appServer;
 	const nativeHookRelayEvents = resolveCodexNativeHookRelayEvents({
 		configuredEvents: options.nativeHookRelay?.events,
 		appServer
 	});
+	preDynamicStartupStages.mark("native-hook-relay");
 	const runAbortController = new AbortController();
 	const abortFromUpstream = () => {
 		runAbortController.abort(params.abortSignal?.reason ?? "upstream_abort");
@@ -4800,15 +4851,19 @@ async function runCodexAppServerAttempt(params, options = {}) {
 		agentId: params.agentId
 	});
 	const agentDir = params.agentDir ?? resolveAgentDir$1(params.config ?? {}, sessionAgentId);
+	preDynamicStartupStages.mark("session-agent");
 	let startupBinding = await readCodexAppServerBinding(params.sessionFile);
+	preDynamicStartupStages.mark("read-binding");
 	const startupBindingAuthProfileId = startupBinding?.authProfileId;
 	startupBinding = await rotateOversizedCodexAppServerStartupBinding({
 		binding: startupBinding,
 		sessionFile: params.sessionFile,
 		agentDir,
 		codexHome: appServer.start.env?.CODEX_HOME,
-		config: params.config
+		config: params.config,
+		contextEngineActive: isActiveHarnessContextEngine(params.contextEngine)
 	});
+	preDynamicStartupStages.mark("rotate-binding");
 	const startupAuthProfileCandidate = params.runtimePlan?.auth.forwardedAuthProfileId ?? params.authProfileId ?? startupBinding?.authProfileId ?? startupBindingAuthProfileId;
 	const startupAuthProfileId = params.authProfileStore ? resolveCodexAppServerAuthProfileId({
 		authProfileId: startupAuthProfileCandidate,
@@ -4819,6 +4874,7 @@ async function runCodexAppServerAttempt(params, options = {}) {
 		agentDir,
 		config: params.config
 	});
+	preDynamicStartupStages.mark("auth-profile");
 	const runtimeParams = {
 		...params,
 		sessionKey: contextSessionKey,
@@ -4837,12 +4893,14 @@ async function runCodexAppServerAttempt(params, options = {}) {
 		agentDir,
 		config: params.config
 	});
-	const startupEnvApiKeyCacheKey = startupAuthProfileId ? void 0 : resolveCodexAppServerEnvApiKeyCacheKey({ startOptions: appServer.start });
+	const startupEnvApiKeyCacheKey = startupAuthProfileId ? void 0 : resolveCodexAppServerFallbackApiKeyCacheKey({ startOptions: appServer.start });
+	preDynamicStartupStages.mark("auth-cache");
 	const nodeExecBlocksNativeExecution = isCodexNativeExecutionBlockedByNodeExecHost(params, {
 		agentId: sessionAgentId,
 		runtimeSessionKey: sandboxSessionKey,
 		sandbox
 	});
+	preDynamicStartupStages.mark("native-exec-policy");
 	const bundleMcpThreadConfig = await loadCodexBundleMcpThreadConfig({
 		workspaceDir: effectiveWorkspace,
 		cfg: params.config,
@@ -4850,12 +4908,14 @@ async function runCodexAppServerAttempt(params, options = {}) {
 		disableTools: params.disableTools,
 		toolsAllow: nodeExecBlocksNativeExecution ? [] : params.toolsAllow
 	});
+	preDynamicStartupStages.mark("bundle-mcp");
 	const sandboxExecServerEnabled = isCodexSandboxExecServerEnabled(pluginConfig);
 	const nativeToolSurfaceEnabled = shouldEnableCodexAppServerNativeToolSurface(params, sandbox, {
 		agentId: sessionAgentId,
 		runtimeSessionKey: sandboxSessionKey,
 		sandboxExecServerEnabled
 	});
+	preDynamicStartupStages.mark("native-tool-surface");
 	for (const diagnostic of bundleMcpThreadConfig.diagnostics) embeddedAgentLog.warn(`bundle-mcp: ${diagnostic.pluginId}: ${diagnostic.message}`);
 	const activeContextEngine = isActiveHarnessContextEngine(params.contextEngine) ? params.contextEngine : void 0;
 	if (activeContextEngine) assertContextEngineHostSupport({
@@ -4864,6 +4924,18 @@ async function runCodexAppServerAttempt(params, options = {}) {
 		host: CODEX_APP_SERVER_CONTEXT_ENGINE_HOST
 	});
 	const hookChannelId = resolveCodexAppServerHookChannelId(params, sandboxSessionKey);
+	preDynamicStartupStages.mark("context-engine-support");
+	const preDynamicSummary = preDynamicStartupStages.snapshot();
+	if (shouldWarnCodexDynamicToolBuildStageSummary(preDynamicSummary)) embeddedAgentLog.warn(`codex app-server pre-dynamic startup timings runId=${params.runId} sessionId=${params.sessionId} totalMs=${preDynamicSummary.totalMs} stages=${formatCodexDynamicToolBuildStageSummary(preDynamicSummary)}`, {
+		runId: params.runId,
+		sessionId: params.sessionId,
+		totalMs: preDynamicSummary.totalMs,
+		stages: preDynamicSummary.stages,
+		hasStartupBinding: Boolean(startupBinding?.threadId),
+		startupAuthProfileId: startupAuthProfileId ?? null,
+		bundleMcpDiagnosticCount: bundleMcpThreadConfig.diagnostics.length,
+		nativeToolSurfaceEnabled
+	});
 	let yieldDetected = false;
 	const tools = await buildDynamicTools({
 		params,
@@ -4875,6 +4947,7 @@ async function runCodexAppServerAttempt(params, options = {}) {
 		runAbortController,
 		sessionAgentId,
 		pluginConfig,
+		profilerEnabled,
 		onYieldDetected: () => {
 			yieldDetected = true;
 		}
@@ -4891,6 +4964,7 @@ async function runCodexAppServerAttempt(params, options = {}) {
 			runAbortController,
 			sessionAgentId,
 			pluginConfig,
+			profilerEnabled,
 			forceHeartbeatTool: true,
 			ignoreRuntimePlan: true,
 			onYieldDetected: () => {
@@ -5818,7 +5892,9 @@ async function runCodexAppServerAttempt(params, options = {}) {
 			...turnId ? { turnId } : {}
 		});
 		embeddedAgentLog.debug("codex app-server raw notification received", correlation);
-		if (notification.method === "turn/completed" && correlation.matchesActiveTurn === false) embeddedAgentLog.warn("codex app-server turn/completed did not match active turn", correlation);
+		if (notification.method === "turn/completed" && correlation.matchesActiveTurn === false) if (correlation.matchesActiveThread) embeddedAgentLog.warn("codex app-server turn/completed did not match active turn", correlation);
+		else embeddedAgentLog.debug("codex app-server turn/completed ignored for other subscribed thread", correlation);
+		if (isCodexNotificationOutsideActiveRun(correlation)) return Promise.resolve();
 		if (!projector || !turnId) {
 			userInputBridge?.handleNotification(notification);
 			pendingNotifications.push(notification);
@@ -6375,16 +6451,10 @@ async function runCodexAppServerAttempt(params, options = {}) {
 	turnTerminalIdleWatchArmed = true;
 	touchTurnCompletionActivity("turn:start", { attemptProgress: true });
 	const abortListener = () => {
-		const shouldRetireClient = timedOut;
 		interruptCodexTurnBestEffort(client, {
 			threadId: thread.threadId,
 			turnId: activeTurnId,
-			timeoutMs: shouldRetireClient ? CODEX_APP_SERVER_INTERRUPT_TIMEOUT_MS : void 0
-		});
-		if (shouldRetireClient) retireCodexAppServerClientAfterTimedOutTurn(client, {
-			threadId: thread.threadId,
-			turnId: activeTurnId,
-			reason: String(runAbortController.signal.reason ?? "timeout")
+			timeoutMs: timedOut ? CODEX_APP_SERVER_INTERRUPT_TIMEOUT_MS : void 0
 		});
 		resolveCompletion?.();
 	};
@@ -6799,7 +6869,10 @@ function createCodexNativeHookRelay(params) {
 			turnStartTimeoutMs: params.turnStartTimeoutMs
 		}),
 		signal: params.signal,
-		command: { timeoutMs: params.options?.gatewayTimeoutMs }
+		command: {
+			nice: 10,
+			timeoutMs: params.options?.gatewayTimeoutMs
+		}
 	});
 }
 function resolveCodexNativeHookRelayEvents(params) {
@@ -6867,19 +6940,6 @@ async function unsubscribeCodexThreadBestEffort(client, params) {
 		});
 	}
 }
-function retireCodexAppServerClientAfterTimedOutTurn(client, params) {
-	const clearedSharedClient = clearSharedCodexAppServerClientIfCurrent(client);
-	if (!clearedSharedClient) {
-		const close = client.close;
-		if (typeof close === "function") close.call(client);
-	}
-	embeddedAgentLog.warn("codex app-server client retired after timed-out turn", {
-		threadId: params.threadId,
-		turnId: params.turnId,
-		reason: params.reason,
-		clearedSharedClient
-	});
-}
 function resolveOpenClawCodingToolsSessionKeys(params, sandboxSessionKey) {
 	return {
 		sessionKey: sandboxSessionKey,
@@ -6895,12 +6955,54 @@ function resolveCodexAppServerHookChannelId(params, sandboxSessionKey) {
 		messageTo: params.messageTo
 	}).channelId;
 }
+const CODEX_DYNAMIC_TOOL_BUILD_WARN_TOTAL_MS = 1e3;
+const CODEX_DYNAMIC_TOOL_BUILD_WARN_STAGE_MS = 500;
+function createCodexDynamicToolBuildStageTracker(options = {}) {
+	if (!options.enabled) return {
+		mark() {},
+		snapshot() {
+			return {
+				totalMs: 0,
+				stages: []
+			};
+		}
+	};
+	const startedAt = Date.now();
+	let previousAt = startedAt;
+	const stages = [];
+	const toMs = (value) => Math.max(0, Math.round(value));
+	return {
+		mark(name) {
+			const currentAt = Date.now();
+			stages.push({
+				name,
+				durationMs: toMs(currentAt - previousAt),
+				elapsedMs: toMs(currentAt - startedAt)
+			});
+			previousAt = currentAt;
+		},
+		snapshot() {
+			return {
+				totalMs: toMs(Date.now() - startedAt),
+				stages: stages.slice()
+			};
+		}
+	};
+}
+function shouldWarnCodexDynamicToolBuildStageSummary(summary) {
+	return summary.totalMs >= CODEX_DYNAMIC_TOOL_BUILD_WARN_TOTAL_MS || summary.stages.some((stage) => stage.durationMs >= CODEX_DYNAMIC_TOOL_BUILD_WARN_STAGE_MS);
+}
+function formatCodexDynamicToolBuildStageSummary(summary) {
+	return summary.stages.length > 0 ? summary.stages.map((stage) => `${stage.name}:${stage.durationMs}ms@${stage.elapsedMs}ms`).join(",") : "none";
+}
 async function buildDynamicTools(input) {
 	const { params } = input;
 	if (params.disableTools || !supportsModelTools(params.model)) return [];
+	const toolBuildStages = createCodexDynamicToolBuildStageTracker({ enabled: input.profilerEnabled });
 	const modelHasVision = params.model.input?.includes("image") ?? false;
 	const agentDir = params.agentDir ?? resolveAgentDir$1(params.config ?? {}, input.sessionAgentId);
 	const createOpenClawCodingTools = (await import("openclaw/plugin-sdk/agent-harness")).createOpenClawCodingTools;
+	toolBuildStages.mark("load-agent-harness-tools");
 	const sessionKeys = resolveOpenClawCodingToolsSessionKeys(params, input.sandboxSessionKey);
 	const allTools = createOpenClawCodingTools({
 		agentId: input.sessionAgentId,
@@ -6965,13 +7067,22 @@ async function buildDynamicTools(input) {
 					message
 				}
 			});
+		},
+		recordToolPrepStage: (name) => {
+			toolBuildStages.mark(name);
 		}
 	});
-	const filteredTools = filterCodexDynamicToolsForAllowlist(filterToolsForVisionInputs(addNodeShellDynamicToolsIfNeeded(addSandboxShellDynamicToolsIfAvailable(isCodexMemoryFlushRun(params) ? filterCodexMemoryFlushDynamicTools(allTools) : filterCodexDynamicTools(allTools, input.pluginConfig), allTools, input), allTools, input), {
+	toolBuildStages.mark("create-openclaw-coding-tools");
+	const codexFilteredTools = addNodeShellDynamicToolsIfNeeded(addSandboxShellDynamicToolsIfAvailable(isCodexMemoryFlushRun(params) ? filterCodexMemoryFlushDynamicTools(allTools) : filterCodexDynamicTools(allTools, input.pluginConfig), allTools, input), allTools, input);
+	toolBuildStages.mark("codex-filtering");
+	const visionFilteredTools = filterToolsForVisionInputs(codexFilteredTools, {
 		modelHasVision,
 		hasInboundImages: (params.images?.length ?? 0) > 0
-	}), includeForcedCodexDynamicToolAllow(params.toolsAllow, params));
-	return normalizeAgentRuntimeTools({
+	});
+	toolBuildStages.mark("vision-filtering");
+	const filteredTools = filterCodexDynamicToolsForAllowlist(visionFilteredTools, includeForcedCodexDynamicToolAllow(params.toolsAllow, params));
+	toolBuildStages.mark("allowlist-filter");
+	const normalizedTools = normalizeAgentRuntimeTools({
 		runtimePlan: input.ignoreRuntimePlan ? void 0 : params.runtimePlan,
 		tools: filteredTools,
 		provider: params.provider,
@@ -6982,6 +7093,27 @@ async function buildDynamicTools(input) {
 		modelApi: params.model.api,
 		model: params.model
 	});
+	toolBuildStages.mark("runtime-normalization");
+	const summary = toolBuildStages.snapshot();
+	if (shouldWarnCodexDynamicToolBuildStageSummary(summary)) {
+		const phase = input.forceHeartbeatTool ? "registered-tools" : "runtime-tools";
+		embeddedAgentLog.warn(`codex app-server dynamic tool build timings runId=${params.runId} sessionId=${params.sessionId} phase=${phase} totalMs=${summary.totalMs} stages=${formatCodexDynamicToolBuildStageSummary(summary)}`, {
+			runId: params.runId,
+			sessionId: params.sessionId,
+			phase,
+			totalMs: summary.totalMs,
+			stages: summary.stages,
+			allToolCount: allTools.length,
+			codexFilteredToolCount: codexFilteredTools.length,
+			visionFilteredToolCount: visionFilteredTools.length,
+			filteredToolCount: filteredTools.length,
+			normalizedToolCount: normalizedTools.length,
+			forceHeartbeatTool: input.forceHeartbeatTool === true,
+			ignoreRuntimePlan: input.ignoreRuntimePlan === true,
+			nativeToolSurfaceEnabled: input.nativeToolSurfaceEnabled === true
+		});
+	}
+	return normalizedTools;
 }
 function includeForcedCodexDynamicToolAllow(toolsAllow, params) {
 	if (toolsAllow === void 0 || hasWildcardCodexToolsAllow(toolsAllow)) return toolsAllow;
@@ -7151,11 +7283,33 @@ function shouldProjectMirroredHistoryForCodexStart(params) {
 	if (!params.historyMessages.some((message) => message.role === "user")) return false;
 	if (params.forceProject) return true;
 	if (!params.startupBinding?.threadId) return true;
+	if (hasUserVisibleHistoryAfterCodexBinding({
+		startupBinding: params.startupBinding,
+		historyMessages: params.historyMessages
+	})) return true;
 	return !areCodexDynamicToolFingerprintsCompatible({
 		previous: params.startupBinding.dynamicToolsFingerprint,
 		next: params.dynamicToolsFingerprint
 	});
 }
+function hasUserVisibleHistoryAfterCodexBinding(params) {
+	const bindingUpdatedAt = Date.parse(params.startupBinding.updatedAt);
+	if (!Number.isFinite(bindingUpdatedAt)) return false;
+	return params.historyMessages.some((message) => {
+		if (message.role !== "user" && message.role !== "assistant") return false;
+		if (isCodexAppServerMirroredTranscriptMessage(message)) return false;
+		const timestamp = typeof message.timestamp === "number" ? message.timestamp : typeof message.timestamp === "string" ? Date.parse(message.timestamp) : NaN;
+		return Number.isFinite(timestamp) && timestamp > bindingUpdatedAt;
+	});
+}
+function isCodexAppServerMirroredTranscriptMessage(message) {
+	const record = message;
+	const idempotencyKey = record.idempotencyKey;
+	if (typeof idempotencyKey === "string" && idempotencyKey.startsWith("codex-app-server:")) return true;
+	const meta = record["__openclaw"];
+	if (!meta || typeof meta !== "object" || Array.isArray(meta)) return false;
+	return typeof meta.mirrorIdentity === "string";
+}
 function readContextEngineThreadBootstrapProjection(projection) {
 	if (projection?.mode !== "thread_bootstrap") return;
 	const epoch = projection.epoch?.trim();
@@ -7473,6 +7627,11 @@ function readRawAssistantTextPreview(item) {
 function isTurnNotification(value, threadId, turnId) {
 	return isCodexNotificationForTurn(value, threadId, turnId);
 }
+function isCodexNotificationOutsideActiveRun(correlation) {
+	if (!Boolean(correlation.threadId || correlation.nestedTurnThreadId)) return false;
+	if (!correlation.matchesActiveThread) return true;
+	return Boolean(correlation.turnId || correlation.nestedTurnId) && correlation.matchesActiveTurn === false;
+}
 function isCurrentThreadTurnRequestParams(value, threadId, turnId) {
 	if (!isJsonObject(value)) return false;
 	return readString(value, "threadId") === threadId && readString(value, "turnId") === turnId;

package/dist/{session-binding-CwNOIDP2.js → session-binding-UFjjws4k.js}

@@ -1,5 +1,5 @@
 import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
-import { s as normalizeCodexServiceTier } from "./config-D6TUuyo2.js";
+import { s as normalizeCodexServiceTier } from "./config-0-UN67Qg.js";
 import { embeddedAgentLog } from "openclaw/plugin-sdk/agent-harness-runtime";
 import fs from "node:fs/promises";
 import { ensureAuthProfileStore, resolveDefaultAgentDir, resolveProviderIdForAuth } from "openclaw/plugin-sdk/agent-runtime";