@openclaw/codex 2026.5.25-beta.1 → 2026.5.26-beta.2

package/dist/{session-binding-CwNOIDP2.js → session-binding-UFjjws4k.js}

@@ -1,5 +1,5 @@
 import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
-import { s as normalizeCodexServiceTier } from "./config-D6TUuyo2.js";
+import { s as normalizeCodexServiceTier } from "./config-0-UN67Qg.js";
 import { embeddedAgentLog } from "openclaw/plugin-sdk/agent-harness-runtime";
 import fs from "node:fs/promises";
 import { ensureAuthProfileStore, resolveDefaultAgentDir, resolveProviderIdForAuth } from "openclaw/plugin-sdk/agent-runtime";

package/dist/{shared-client-CZP1DjaN.js → shared-client-8kIrP817.js}

@@ -1,9 +1,10 @@
 import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
-import { l as resolveCodexAppServerRuntimeOptions, n as codexAppServerStartOptionsKey } from "./config-D6TUuyo2.js";
-import { c as resolveCodexAppServerSpawnEnv, o as MANAGED_CODEX_APP_SERVER_PACKAGE, t as CodexAppServerClient } from "./client-SrtuTTVa.js";
+import { l as resolveCodexAppServerRuntimeOptions, n as codexAppServerStartOptionsKey } from "./config-0-UN67Qg.js";
+import { c as resolveCodexAppServerSpawnEnv, o as MANAGED_CODEX_APP_SERVER_PACKAGE, t as CodexAppServerClient } from "./client-BVK_jmHW.js";
 import { createRequire } from "node:module";
 import { createHash } from "node:crypto";
-import { constants, readFileSync } from "node:fs";
+import fsSync, { constants, readFileSync } from "node:fs";
+import os from "node:os";
 import fs, { access } from "node:fs/promises";
 import path from "node:path";
 import { ensureAuthProfileStore, ensureAuthProfileStoreWithoutExternalProfiles, loadAuthProfileStoreForSecretsRuntime, refreshOAuthCredentialForRuntime, resolveApiKeyForProfile, resolveAuthProfileOrder, resolveDefaultAgentDir, resolvePersistedAuthProfileOwnerAgentDir, resolveProviderIdForAuth } from "openclaw/plugin-sdk/agent-runtime";
@@ -18,6 +19,8 @@ const HOME_ENV_VAR = "HOME";
 const CODEX_APP_SERVER_HOME_DIRNAME = "codex-home";
 const CODEX_APP_SERVER_API_KEY_ENV_VARS = ["CODEX_API_KEY", "OPENAI_API_KEY"];
 const CODEX_APP_SERVER_HOME_ENV_VARS = [CODEX_HOME_ENV_VAR, HOME_ENV_VAR];
+const CODEX_AUTH_JSON_FILENAME = "auth.json";
+const CODEX_HOME_DIRNAME = ".codex";
 async function bridgeCodexAppServerStartOptions(params) {
 	if (params.startOptions.transport !== "stdio") return params.startOptions;
 	const isolatedStartOptions = await withAgentCodexHomeEnvironment(params.startOptions, params.agentDir);
@@ -67,6 +70,14 @@ function ensureCodexAppServerAuthProfileStore(params) {
 	});
 }
 function resolveCodexAppServerAuthProfileStore(params) {
+	if (params.authProfileStore) {
+		const providedProfileId = resolveCodexAppServerAuthProfileId({
+			authProfileId: params.authProfileId,
+			store: params.authProfileStore,
+			config: params.config
+		});
+		if (providedProfileId && params.authProfileStore.profiles[providedProfileId]) return params.authProfileStore;
+	}
 	const overlaidStore = ensureCodexAppServerAuthProfileStore({
 		agentDir: params.agentDir,
 		authProfileId: params.authProfileId,
@@ -132,6 +143,10 @@ function resolveCodexAppServerEnvApiKeyCacheKey(params) {
 	hash.update(apiKey.value);
 	return `${apiKey.key}:sha256:${hash.digest("hex")}`;
 }
+function resolveCodexAppServerFallbackApiKeyCacheKey(params) {
+	if (params.startOptions.transport !== "stdio") return;
+	return resolveCodexAppServerEnvApiKeyCacheKey(params) ?? resolveCodexCliAuthFileApiKeyCacheKey(params.baseEnv ?? process.env);
+}
 function fingerprintApiKeyAuthProfileCacheKey(apiKey) {
 	const hash = createHash("sha256");
 	hash.update("openclaw:codex:app-server-auth-profile-api-key:v1");
@@ -146,6 +161,13 @@ function fingerprintTokenAuthProfileCacheKey(accessToken) {
 	hash.update(accessToken);
 	return `token:sha256:${hash.digest("hex")}`;
 }
+function fingerprintCodexCliAuthFileApiKeyCacheKey(apiKey) {
+	const hash = createHash("sha256");
+	hash.update("openclaw:codex:app-server-cli-auth-json-api-key:v1");
+	hash.update("\0");
+	hash.update(apiKey);
+	return `CODEX_AUTH_JSON:sha256:${hash.digest("hex")}`;
+}
 function resolveCodexAppServerHomeDir(agentDir) {
 	return path.join(path.resolve(agentDir), CODEX_APP_SERVER_HOME_DIRNAME);
 }
@@ -183,9 +205,10 @@ async function applyCodexAppServerAuthProfile(params) {
 	if (!loginParams) {
 		if (params.startOptions?.transport !== "stdio") return;
 		const env = resolveCodexAppServerSpawnEnv(params.startOptions, process.env);
-		const fallbackLoginParams = await resolveCodexAppServerEnvApiKeyLoginParams({
+		const fallbackLoginParams = await resolveCodexAppServerFallbackApiKeyLoginParams({
 			client: params.client,
-			env
+			env,
+			codexCliAuthEnv: process.env
 		});
 		if (fallbackLoginParams) await params.client.request("account/login/start", fallbackLoginParams);
 		return;
@@ -230,8 +253,8 @@ async function resolveCodexAppServerAuthProfileLoginParamsInternal(params) {
 	if (!loginParams) throw new Error(`Codex app-server auth profile "${profileId}" does not contain usable credentials.`);
 	return loginParams;
 }
-async function resolveCodexAppServerEnvApiKeyLoginParams(params) {
-	const apiKey = readFirstNonEmptyEnv(params.env, CODEX_APP_SERVER_API_KEY_ENV_VARS);
+async function resolveCodexAppServerFallbackApiKeyLoginParams(params) {
+	const apiKey = readFirstNonEmptyEnv(params.env, CODEX_APP_SERVER_API_KEY_ENV_VARS) ?? await readCodexCliAuthFileApiKey(params.codexCliAuthEnv);
 	if (!apiKey) return;
 	if ((await params.client.request("account/read", { refreshToken: false })).account) return;
 	return {
@@ -239,6 +262,45 @@ async function resolveCodexAppServerEnvApiKeyLoginParams(params) {
 		apiKey
 	};
 }
+function resolveCodexCliAuthFilePath(env) {
+	const configuredCodexHome = env[CODEX_HOME_ENV_VAR]?.trim();
+	if (configuredCodexHome) return path.join(resolveHomeRelativePath(configuredCodexHome, env), CODEX_AUTH_JSON_FILENAME);
+	const home = env[HOME_ENV_VAR]?.trim() || env.USERPROFILE?.trim() || os.homedir();
+	return path.join(home, CODEX_HOME_DIRNAME, CODEX_AUTH_JSON_FILENAME);
+}
+function resolveHomeRelativePath(value, env) {
+	if (value === "~" || value.startsWith("~/") || value.startsWith("~\\")) {
+		const home = env[HOME_ENV_VAR]?.trim() || env.USERPROFILE?.trim() || os.homedir();
+		return path.join(home, value.slice(value === "~" ? 1 : 2));
+	}
+	return value;
+}
+function parseCodexCliAuthFileApiKey(raw) {
+	let parsed;
+	try {
+		parsed = JSON.parse(raw);
+	} catch {
+		return;
+	}
+	if (!parsed || typeof parsed !== "object") return;
+	const apiKey = parsed.OPENAI_API_KEY;
+	return typeof apiKey === "string" && apiKey.trim() ? apiKey.trim() : void 0;
+}
+async function readCodexCliAuthFileApiKey(env) {
+	try {
+		return parseCodexCliAuthFileApiKey(await fs.readFile(resolveCodexCliAuthFilePath(env), "utf8"));
+	} catch {
+		return;
+	}
+}
+function resolveCodexCliAuthFileApiKeyCacheKey(env) {
+	try {
+		const apiKey = parseCodexCliAuthFileApiKey(fsSync.readFileSync(resolveCodexCliAuthFilePath(env), "utf8"));
+		return apiKey ? fingerprintCodexCliAuthFileApiKeyCacheKey(apiKey) : void 0;
+	} catch {
+		return;
+	}
+}
 async function resolveLoginParamsForCredential(profileId, credential, params) {
 	if (credential.type === "api_key") {
 		const apiKey = (await resolveApiKeyForProfile({
@@ -470,35 +532,77 @@ var shared_client_exports = /* @__PURE__ */ __exportAll({
 	clearSharedCodexAppServerClientIfCurrent: () => clearSharedCodexAppServerClientIfCurrent,
 	clearSharedCodexAppServerClientIfCurrentAndWait: () => clearSharedCodexAppServerClientIfCurrentAndWait,
 	createIsolatedCodexAppServerClient: () => createIsolatedCodexAppServerClient,
-	getSharedCodexAppServerClient: () => getSharedCodexAppServerClient
+	getLeasedSharedCodexAppServerClient: () => getLeasedSharedCodexAppServerClient,
+	getSharedCodexAppServerClient: () => getSharedCodexAppServerClient,
+	releaseLeasedSharedCodexAppServerClient: () => releaseLeasedSharedCodexAppServerClient,
+	retireSharedCodexAppServerClientIfCurrent: () => retireSharedCodexAppServerClientIfCurrent
 });
 const SHARED_CODEX_APP_SERVER_CLIENT_STATE = Symbol.for("openclaw.codexAppServerClientState");
 function getSharedCodexAppServerClientState() {
 	const globalState = globalThis;
 	const state = globalState[SHARED_CODEX_APP_SERVER_CLIENT_STATE];
-	if (isSharedCodexAppServerClientState(state)) return state;
+	const keyedState = readKeyedSharedCodexAppServerClientState(state);
+	if (keyedState) {
+		const clients = keyedState.clients;
+		for (const entry of clients.values()) {
+			entry.activeLeases ??= 0;
+			entry.closeWhenIdle ??= false;
+		}
+		const nextState = {
+			clients,
+			leasedReleases: keyedState.leasedReleases instanceof WeakMap ? keyedState.leasedReleases : /* @__PURE__ */ new WeakMap()
+		};
+		globalState[SHARED_CODEX_APP_SERVER_CLIENT_STATE] = nextState;
+		return nextState;
+	}
 	const legacyState = readLegacySharedCodexAppServerClientState(state);
 	const clients = /* @__PURE__ */ new Map();
 	if (legacyState?.key && (legacyState.client || legacyState.promise)) {
 		const legacyKey = legacyState.key;
 		clients.set(legacyKey, {
 			client: legacyState.client,
-			promise: legacyState.promise
+			promise: legacyState.promise,
+			activeLeases: 0,
+			closeWhenIdle: false
 		});
 		legacyState.client?.addCloseHandler((closedClient) => clearSharedClientEntryIfCurrent(legacyKey, closedClient));
 	}
-	const nextState = { clients };
+	const nextState = {
+		clients,
+		leasedReleases: /* @__PURE__ */ new WeakMap()
+	};
 	globalState[SHARED_CODEX_APP_SERVER_CLIENT_STATE] = nextState;
 	return nextState;
 }
-function isSharedCodexAppServerClientState(value) {
-	return value !== null && typeof value === "object" && value.clients instanceof Map;
+function readKeyedSharedCodexAppServerClientState(value) {
+	return value !== null && typeof value === "object" && value.clients instanceof Map ? value : void 0;
 }
 function readLegacySharedCodexAppServerClientState(value) {
 	if (value === null || typeof value !== "object") return;
 	return value;
 }
 async function getSharedCodexAppServerClient(options) {
+	return (await acquireSharedCodexAppServerClient(options)).client;
+}
+async function getLeasedSharedCodexAppServerClient(options) {
+	const acquired = await acquireSharedCodexAppServerClient(options, { leased: true });
+	const state = getSharedCodexAppServerClientState();
+	const releases = state.leasedReleases.get(acquired.client) ?? [];
+	releases.push(acquired.release);
+	state.leasedReleases.set(acquired.client, releases);
+	return acquired.client;
+}
+function releaseLeasedSharedCodexAppServerClient(client) {
+	const state = getSharedCodexAppServerClientState();
+	const releases = state.leasedReleases.get(client);
+	if (!releases) return false;
+	const release = releases.pop();
+	if (!release) return false;
+	if (releases.length === 0) state.leasedReleases.delete(client);
+	release();
+	return true;
+}
+async function acquireSharedCodexAppServerClient(options, leaseOptions) {
 	const agentDir = options?.agentDir ?? resolveDefaultAgentDir(options?.config ?? {});
 	const usesNativeAuth = options?.authProfileId === null;
 	const requestedAuthProfileId = options?.authProfileId === null ? void 0 : options?.authProfileId;
@@ -513,9 +617,11 @@ async function getSharedCodexAppServerClient(options) {
 		authProfileId: usesNativeAuth ? null : authProfileId,
 		config: options?.config
 	});
+	const fallbackApiKeyCacheKey = authProfileId ? void 0 : resolveCodexAppServerFallbackApiKeyCacheKey({ startOptions });
 	const key = codexAppServerStartOptionsKey(startOptions, {
 		authProfileId,
-		agentDir: usesNativeAuth ? void 0 : agentDir
+		agentDir: usesNativeAuth ? void 0 : agentDir,
+		fallbackApiKeyCacheKey
 	});
 	const state = getSharedCodexAppServerClientState();
 	const entry = getOrCreateSharedClientEntry(state, key);
@@ -539,7 +645,12 @@ async function getSharedCodexAppServerClient(options) {
 		}
 	})());
 	try {
-		return await withTimeout$1(sharedPromise, options?.timeoutMs ?? 0, "codex app-server initialize timed out");
+		const client = await withTimeout$1(sharedPromise, options?.timeoutMs ?? 0, "codex app-server initialize timed out");
+		const release = leaseOptions?.leased ? retainSharedClientEntry(entry) : void 0;
+		return release ? {
+			client,
+			release
+		} : { client };
 	} catch (error) {
 		const currentEntry = state.clients.get(key);
 		if (currentEntry?.promise === sharedPromise) clearSharedClientEntry(key, currentEntry);
@@ -589,6 +700,24 @@ function clearSharedCodexAppServerClientIfCurrent(client) {
 	}
 	return false;
 }
+function retireSharedCodexAppServerClientIfCurrent(client) {
+	if (!client) return;
+	const state = getSharedCodexAppServerClientState();
+	for (const [key, entry] of state.clients) if (entry.client === client) {
+		state.clients.delete(key);
+		entry.closeWhenIdle = true;
+		const closed = closeRetiredSharedClientEntryIfIdle(entry);
+		return {
+			activeLeases: entry.activeLeases,
+			closed
+		};
+	}
+	const activeLeases = state.leasedReleases.get(client)?.length ?? 0;
+	if (activeLeases > 0) return {
+		activeLeases,
+		closed: false
+	};
+}
 async function clearSharedCodexAppServerClientIfCurrentAndWait(client, options) {
 	if (!client) return false;
 	const state = getSharedCodexAppServerClientState();
@@ -608,7 +737,10 @@ async function clearSharedCodexAppServerClientAndWait(options) {
 function getOrCreateSharedClientEntry(state, key) {
 	let entry = state.clients.get(key);
 	if (!entry) {
-		entry = {};
+		entry = {
+			activeLeases: 0,
+			closeWhenIdle: false
+		};
 		state.clients.set(key, entry);
 	}
 	return entry;
@@ -623,8 +755,26 @@ function clearSharedClientEntryIfCurrent(key, client) {
 	const state = getSharedCodexAppServerClientState();
 	if (state.clients.get(key)?.client === client) state.clients.delete(key);
 }
+function retainSharedClientEntry(entry) {
+	let released = false;
+	entry.activeLeases += 1;
+	return () => {
+		if (released) return;
+		released = true;
+		entry.activeLeases = Math.max(0, entry.activeLeases - 1);
+		closeRetiredSharedClientEntryIfIdle(entry);
+	};
+}
+function closeRetiredSharedClientEntryIfIdle(entry) {
+	if (!entry.closeWhenIdle || entry.activeLeases > 0 || !entry.client) return false;
+	const client = entry.client;
+	entry.closeWhenIdle = false;
+	entry.client = void 0;
+	client.close();
+	return true;
+}
 function collectSharedClients(state) {
 	return [...new Set([...state.clients.values()].map((entry) => entry.client).filter((client) => Boolean(client)))];
 }
 //#endregion
-export { shared_client_exports as a, resolveCodexAppServerAuthAccountCacheKey as c, resolveCodexAppServerEnvApiKeyCacheKey as d, resolveCodexAppServerHomeDir as f, getSharedCodexAppServerClient as i, resolveCodexAppServerAuthProfileId as l, clearSharedCodexAppServerClientIfCurrentAndWait as n, withTimeout$1 as o, createIsolatedCodexAppServerClient as r, refreshCodexAppServerAuthTokens as s, clearSharedCodexAppServerClientIfCurrent as t, resolveCodexAppServerAuthProfileIdForAgent as u };
+export { releaseLeasedSharedCodexAppServerClient as a, withTimeout$1 as c, resolveCodexAppServerAuthProfileId as d, resolveCodexAppServerAuthProfileIdForAgent as f, getLeasedSharedCodexAppServerClient as i, refreshCodexAppServerAuthTokens as l, resolveCodexAppServerHomeDir as m, clearSharedCodexAppServerClientIfCurrentAndWait as n, retireSharedCodexAppServerClientIfCurrent as o, resolveCodexAppServerFallbackApiKeyCacheKey as p, createIsolatedCodexAppServerClient as r, shared_client_exports as s, clearSharedCodexAppServerClientIfCurrent as t, resolveCodexAppServerAuthAccountCacheKey as u };

package/dist/{side-question-Cb4COOQ9.js → side-question-DU7en3_R.js}

@@ -1,17 +1,17 @@
-import { c as readCodexPluginConfig, f as shouldAutoApproveCodexAppServerApprovals, l as resolveCodexAppServerRuntimeOptions } from "./config-D6TUuyo2.js";
-import { a as readCodexDynamicToolCallParams, c as readCodexTurn, i as assertCodexTurnStartResponse, t as assertCodexThreadForkResponse } from "./protocol-validators-_gKDcd0x.js";
-import { i as isCodexAppServerApprovalRequest, l as isJsonObject } from "./client-SrtuTTVa.js";
-import { _ as mergeCodexThreadConfigs, f as resolveCodexAppServerModelProvider, p as resolveReasoningEffort, r as buildCodexRuntimeThreadConfig, t as CODEX_NATIVE_PERSONALITY_NONE } from "./thread-lifecycle-CXMd9UgJ.js";
-import { i as readCodexAppServerBinding } from "./session-binding-CwNOIDP2.js";
-import { i as readCodexNotificationTurnId, m as formatCodexUsageLimitErrorMessage, r as readCodexNotificationThreadId } from "./notification-correlation-D7tJW3FW.js";
-import { i as getSharedCodexAppServerClient, s as refreshCodexAppServerAuthTokens } from "./shared-client-CZP1DjaN.js";
+import { c as readCodexPluginConfig, f as shouldAutoApproveCodexAppServerApprovals, l as resolveCodexAppServerRuntimeOptions } from "./config-0-UN67Qg.js";
+import { a as readCodexDynamicToolCallParams, c as readCodexTurn, i as assertCodexTurnStartResponse, t as assertCodexThreadForkResponse } from "./protocol-validators-DtjYmUw_.js";
+import { i as isCodexAppServerApprovalRequest, l as isJsonObject } from "./client-BVK_jmHW.js";
+import { f as resolveCodexAppServerModelProvider, p as resolveReasoningEffort, r as buildCodexRuntimeThreadConfig, t as CODEX_NATIVE_PERSONALITY_NONE, v as mergeCodexThreadConfigs } from "./thread-lifecycle-CUXQezJL.js";
+import { i as readCodexAppServerBinding } from "./session-binding-UFjjws4k.js";
+import { i as readCodexNotificationTurnId, m as formatCodexUsageLimitErrorMessage, r as readCodexNotificationThreadId } from "./notification-correlation-YINts3PA.js";
+import { a as releaseLeasedSharedCodexAppServerClient, i as getLeasedSharedCodexAppServerClient, l as refreshCodexAppServerAuthTokens } from "./shared-client-8kIrP817.js";
 import { n as resolveCodexNativeExecutionBlock } from "./sandbox-guard-CTnEWuor.js";
-import { a as resolveCodexDynamicToolsLoading, n as filterCodexDynamicTools, t as createCodexDynamicToolBridge } from "./dynamic-tools-BXAE1U1-.js";
-import { a as handleCodexAppServerElicitationRequest, c as emitDynamicToolTerminalDiagnostic, i as buildCodexNativeHookRelayDisabledConfig, l as handleCodexAppServerApprovalRequest, n as CODEX_NATIVE_HOOK_RELAY_EVENTS, o as emitDynamicToolErrorDiagnostic, r as buildCodexNativeHookRelayConfig, s as emitDynamicToolStartedDiagnostic, t as filterToolsForVisionInputs } from "./vision-tools-CETeQgze.js";
+import { a as resolveCodexDynamicToolsLoading, n as filterCodexDynamicTools, t as createCodexDynamicToolBridge } from "./dynamic-tools-DlEefKNQ.js";
+import { a as handleCodexAppServerElicitationRequest, c as emitDynamicToolTerminalDiagnostic, i as buildCodexNativeHookRelayDisabledConfig, l as handleCodexAppServerApprovalRequest, n as CODEX_NATIVE_HOOK_RELAY_EVENTS, o as emitDynamicToolErrorDiagnostic, r as buildCodexNativeHookRelayConfig, s as emitDynamicToolStartedDiagnostic, t as filterToolsForVisionInputs } from "./vision-tools-DqpLmF5H.js";
 import { n as rememberCodexRateLimits, t as readRecentCodexRateLimits } from "./rate-limit-cache-N66I-Rd7.js";
 import { buildAgentHookContextChannelFields, embeddedAgentLog, formatErrorMessage, registerNativeHookRelay, resolveAgentDir, resolveAttemptSpawnWorkspaceDir, resolveModelAuthMode, resolveSandboxContext, resolveSessionAgentIds, supportsModelTools } from "openclaw/plugin-sdk/agent-harness-runtime";
 //#region extensions/codex/src/app-server/side-question.ts
-const CODEX_SIDE_DYNAMIC_TOOL_TIMEOUT_MS = 3e4;
+const CODEX_SIDE_DYNAMIC_TOOL_TIMEOUT_MS = 9e4;
 const CODEX_SIDE_DYNAMIC_TOOL_MAX_TIMEOUT_MS = 6e5;
 const CODEX_SIDE_DYNAMIC_IMAGE_GENERATION_TOOL_TIMEOUT_MS = 12e4;
 const CODEX_SIDE_DYNAMIC_IMAGE_TOOL_TIMEOUT_MS = 6e4;
@@ -60,7 +60,7 @@ async function runCodexAppServerSideQuestion(params, options = {}) {
 	const pluginConfig = readCodexPluginConfig(options.pluginConfig);
 	const appServer = resolveCodexAppServerRuntimeOptions({ pluginConfig });
 	const authProfileId = params.authProfileId ?? binding.authProfileId;
-	const client = await getSharedCodexAppServerClient({
+	const client = await getLeasedSharedCodexAppServerClient({
 		startOptions: appServer.start,
 		timeoutMs: appServer.requestTimeoutMs,
 		authProfileId,
@@ -272,6 +272,7 @@ async function runCodexAppServerSideQuestion(params, options = {}) {
 				timeoutMs: appServer.requestTimeoutMs
 			});
 		} finally {
+			releaseLeasedSharedCodexAppServerClient(client);
 			nativeHookRelay?.unregister();
 		}
 	}

package/dist/test-api.js

@@ -1,6 +1,6 @@
-import { l as resolveCodexAppServerRuntimeOptions } from "./config-D6TUuyo2.js";
-import { a as buildDeveloperInstructions, l as buildTurnStartParams, o as buildThreadResumeParams, s as buildThreadStartParams } from "./thread-lifecycle-CXMd9UgJ.js";
-import { n as filterCodexDynamicTools, t as createCodexDynamicToolBridge } from "./dynamic-tools-BXAE1U1-.js";
+import { l as resolveCodexAppServerRuntimeOptions } from "./config-0-UN67Qg.js";
+import { a as buildDeveloperInstructions, l as buildTurnStartParams, o as buildThreadResumeParams, s as buildThreadStartParams } from "./thread-lifecycle-CUXQezJL.js";
+import { n as filterCodexDynamicTools, t as createCodexDynamicToolBridge } from "./dynamic-tools-DlEefKNQ.js";
 //#region extensions/codex/test-api.ts
 function resolveCodexPromptSnapshotAppServerOptions(pluginConfig) {
 	return resolveCodexAppServerRuntimeOptions({

package/dist/{thread-lifecycle-CXMd9UgJ.js → thread-lifecycle-CUXQezJL.js}

@@ -1,9 +1,9 @@
-import { d as resolveCodexPluginsPolicy, r as codexSandboxPolicyForTurn, t as CODEX_PLUGINS_MARKETPLACE_NAME } from "./config-D6TUuyo2.js";
-import { n as assertCodexThreadResumeResponse, r as assertCodexThreadStartResponse } from "./protocol-validators-_gKDcd0x.js";
-import { a as isCodexAppServerConnectionClosedError, l as isJsonObject } from "./client-SrtuTTVa.js";
+import { d as resolveCodexPluginsPolicy, r as codexSandboxPolicyForTurn, t as CODEX_PLUGINS_MARKETPLACE_NAME } from "./config-0-UN67Qg.js";
+import { n as assertCodexThreadResumeResponse, r as assertCodexThreadStartResponse } from "./protocol-validators-DtjYmUw_.js";
+import { a as isCodexAppServerConnectionClosedError, l as isJsonObject } from "./client-BVK_jmHW.js";
 import { CODEX_GPT5_HEARTBEAT_PROMPT_OVERLAY } from "./prompt-overlay.js";
 import { isModernCodexModel } from "./provider.js";
-import { i as readCodexAppServerBinding, n as isCodexAppServerNativeAuthProfile, o as writeCodexAppServerBinding, t as clearCodexAppServerBinding } from "./session-binding-CwNOIDP2.js";
+import { i as readCodexAppServerBinding, n as isCodexAppServerNativeAuthProfile, o as writeCodexAppServerBinding, t as clearCodexAppServerBinding } from "./session-binding-UFjjws4k.js";
 import crypto from "node:crypto";
 import { isRecord } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { embeddedAgentLog, isActiveHarnessContextEngine } from "openclaw/plugin-sdk/agent-harness-runtime";
@@ -12,6 +12,7 @@ import { listRegisteredPluginAgentPromptGuidance } from "openclaw/plugin-sdk/plu
 import { redactSensitiveFieldValue, redactToolPayloadText } from "openclaw/plugin-sdk/logging-core";
 import "node:fs/promises";
 import "node:path";
+import { isDiagnosticFlagEnabled } from "openclaw/plugin-sdk/diagnostic-runtime";
 //#region extensions/codex/src/app-server/context-engine-projection.ts
 const CONTEXT_HEADER = "OpenClaw assembled context for this turn:";
 const CONTEXT_OPEN = "<conversation_context>";
@@ -1067,6 +1068,12 @@ function stableStringify(value) {
 	return JSON.stringify(value);
 }
 //#endregion
+//#region extensions/codex/src/app-server/profiler-flag.ts
+const PROFILER_FLAGS = ["profiler", "codex.profiler"];
+function isCodexAppServerProfilerEnabled(config, env = process.env) {
+	return PROFILER_FLAGS.some((flag) => isDiagnosticFlagEnabled(flag, config, env));
+}
+//#endregion
 //#region extensions/codex/src/app-server/thread-lifecycle.ts
 const CODEX_NATIVE_PERSONALITY_NONE = "none";
 const CODEX_CODE_MODE_THREAD_CONFIG = {
@@ -1078,17 +1085,81 @@ const CODEX_CODE_MODE_DISABLED_THREAD_CONFIG = {
 	"features.code_mode_only": false
 };
 const CODEX_LIGHTWEIGHT_CONTEXT_THREAD_CONFIG = { project_doc_max_bytes: 0 };
+const CODEX_THREAD_LIFECYCLE_TIMING_WARN_TOTAL_MS = 1e3;
+const CODEX_THREAD_LIFECYCLE_TIMING_WARN_STAGE_MS = 500;
+function createCodexThreadLifecycleTimingTracker(options = {}) {
+	if (!options.enabled) return {
+		async measure(_name, run) {
+			return await run();
+		},
+		measureSync(_name, run) {
+			return run();
+		},
+		logIfSlow() {}
+	};
+	const startedAt = Date.now();
+	let didLog = false;
+	const spans = [];
+	const toMs = (value) => Math.max(0, Math.round(value));
+	const record = (name, spanStartedAt) => {
+		spans.push({
+			name,
+			durationMs: toMs(Date.now() - spanStartedAt),
+			elapsedMs: toMs(Date.now() - startedAt)
+		});
+	};
+	const snapshot = () => ({
+		totalMs: toMs(Date.now() - startedAt),
+		spans: spans.slice()
+	});
+	const shouldLog = (summary) => summary.totalMs >= CODEX_THREAD_LIFECYCLE_TIMING_WARN_TOTAL_MS || summary.spans.some((span) => span.durationMs >= CODEX_THREAD_LIFECYCLE_TIMING_WARN_STAGE_MS);
+	const formatSpans = (summary) => summary.spans.length > 0 ? summary.spans.map((span) => `${span.name}:${span.durationMs}ms@${span.elapsedMs}ms`).join(",") : "none";
+	return {
+		async measure(name, run) {
+			const spanStartedAt = Date.now();
+			try {
+				return await run();
+			} finally {
+				record(name, spanStartedAt);
+			}
+		},
+		measureSync(name, run) {
+			const spanStartedAt = Date.now();
+			try {
+				return run();
+			} finally {
+				record(name, spanStartedAt);
+			}
+		},
+		logIfSlow(params) {
+			if (didLog) return;
+			const summary = snapshot();
+			if (!shouldLog(summary)) return;
+			didLog = true;
+			embeddedAgentLog.warn(`codex app-server thread lifecycle timings runId=${params.runId} sessionId=${params.sessionId} sessionKey=${params.sessionKey ?? "unknown"} action=${params.action} totalMs=${summary.totalMs} stages=${formatSpans(summary)}`, {
+				runId: params.runId,
+				sessionId: params.sessionId,
+				sessionKey: params.sessionKey,
+				action: params.action,
+				threadId: params.threadId,
+				totalMs: summary.totalMs,
+				spans: summary.spans
+			});
+		}
+	};
+}
 async function startOrResumeThread(params) {
-	const dynamicToolsFingerprint = fingerprintDynamicTools(params.dynamicTools);
-	const contextEngineBinding = buildContextEngineBinding(params.params, params.contextEngineProjection);
+	const lifecycleTiming = createCodexThreadLifecycleTimingTracker({ enabled: isCodexAppServerProfilerEnabled(params.params.config) });
+	const dynamicToolsFingerprint = lifecycleTiming.measureSync("fingerprint_dynamic_tools", () => fingerprintDynamicTools(params.dynamicTools));
+	const contextEngineBinding = lifecycleTiming.measureSync("context_engine_binding", () => buildContextEngineBinding(params.params, params.contextEngineProjection));
 	const userMcpServersConfigPatch = params.userMcpServersEnabled === false ? void 0 : buildCodexUserMcpServersThreadConfigPatch(params.params.config, { agentId: params.agentId ?? params.params.agentId });
 	const userMcpServersFingerprint = fingerprintUserMcpServersConfigPatch(userMcpServersConfigPatch);
 	const environmentSelectionFingerprint = fingerprintEnvironmentSelection(params.environmentSelection);
-	let binding = await readCodexAppServerBinding(params.params.sessionFile, {
+	let binding = await lifecycleTiming.measure("read_binding", () => readCodexAppServerBinding(params.params.sessionFile, {
 		authProfileStore: params.params.authProfileStore,
 		agentDir: params.params.agentDir,
 		config: params.params.config
-	});
+	}));
 	let preserveExistingBinding = false;
 	let rotatedContextEngineBinding = false;
 	let prebuiltPluginThreadConfig;
@@ -1142,7 +1213,7 @@ async function startOrResumeThread(params) {
 			binding,
 			pluginThreadConfig: params.pluginThreadConfig
 		})) try {
-			prebuiltPluginThreadConfig = await params.pluginThreadConfig?.build();
+			prebuiltPluginThreadConfig = await lifecycleTiming.measure("plugin_config_recovery", () => params.pluginThreadConfig?.build());
 			pluginBindingStale = prebuiltPluginThreadConfig?.fingerprint !== binding.pluginAppsFingerprint;
 		} catch (error) {
 			embeddedAgentLog.warn("codex app-server plugin app config recovery check failed", {
@@ -1174,7 +1245,7 @@ async function startOrResumeThread(params) {
 	} else try {
 		const authProfileId = params.params.authProfileId ?? binding.authProfileId;
 		const resumeConfig = mergeCodexThreadConfigs(params.config, userMcpServersConfigPatch, params.finalConfigPatch);
-		const response = assertCodexThreadResumeResponse(await params.client.request("thread/resume", buildThreadResumeParams(params.params, {
+		const resumeParams = lifecycleTiming.measureSync("thread_resume_params", () => buildThreadResumeParams(params.params, {
 			threadId: binding.threadId,
 			authProfileId,
 			appServer: params.appServer,
@@ -1183,7 +1254,8 @@ async function startOrResumeThread(params) {
 			config: resumeConfig,
 			nativeCodeModeEnabled: params.nativeCodeModeEnabled,
 			nativeCodeModeOnlyEnabled: params.nativeCodeModeOnlyEnabled
-		})));
+		}));
+		const response = assertCodexThreadResumeResponse(await lifecycleTiming.measure("thread_resume_request", () => params.client.request("thread/resume", resumeParams)));
 		const boundAuthProfileId = authProfileId;
 		const fallbackModelProvider = resolveCodexAppServerModelProvider({
 			provider: params.params.provider,
@@ -1193,7 +1265,7 @@ async function startOrResumeThread(params) {
 			config: params.params.config
 		});
 		const nextMcpServersFingerprint = params.mcpServersFingerprintEvaluated === true ? params.mcpServersFingerprint : binding.mcpServersFingerprint;
-		await writeCodexAppServerBinding(params.params.sessionFile, {
+		await lifecycleTiming.measure("thread_resume_write_binding", () => writeCodexAppServerBinding(params.params.sessionFile, {
 			threadId: response.thread.id,
 			cwd: params.cwd,
 			authProfileId: boundAuthProfileId,
@@ -1212,7 +1284,7 @@ async function startOrResumeThread(params) {
 			authProfileStore: params.params.authProfileStore,
 			agentDir: params.params.agentDir,
 			config: params.params.config
-		});
+		}));
 		if (contextEngineBinding) embeddedAgentLog.info("codex app-server wrote context-engine thread binding", {
 			sessionId: params.params.sessionId,
 			sessionKey: params.params.sessionKey,
@@ -1222,6 +1294,13 @@ async function startOrResumeThread(params) {
 			fingerprint: contextEngineBinding.projection?.fingerprint,
 			action: "resumed"
 		});
+		lifecycleTiming.logIfSlow({
+			runId: params.params.runId,
+			sessionId: params.params.sessionId,
+			sessionKey: params.params.sessionKey,
+			threadId: response.thread.id,
+			action: "resumed"
+		});
 		return {
 			...binding,
 			threadId: response.thread.id,
@@ -1244,9 +1323,9 @@ async function startOrResumeThread(params) {
 		embeddedAgentLog.warn("codex app-server thread resume failed; starting a new thread", { error });
 		await clearCodexAppServerBinding(params.params.sessionFile);
 	}
-	const pluginThreadConfig = params.pluginThreadConfig?.enabled ? prebuiltPluginThreadConfig ?? await params.pluginThreadConfig.build() : void 0;
-	const config = mergeCodexThreadConfigs(params.config, userMcpServersConfigPatch, pluginThreadConfig?.configPatch, params.finalConfigPatch);
-	const response = assertCodexThreadStartResponse(await params.client.request("thread/start", buildThreadStartParams(params.params, {
+	const pluginThreadConfig = params.pluginThreadConfig?.enabled ? prebuiltPluginThreadConfig ?? await lifecycleTiming.measure("plugin_config_build", () => params.pluginThreadConfig?.build()) : void 0;
+	const config = lifecycleTiming.measureSync("merge_thread_config", () => mergeCodexThreadConfigs(params.config, userMcpServersConfigPatch, pluginThreadConfig?.configPatch, params.finalConfigPatch));
+	const startParams = lifecycleTiming.measureSync("thread_start_params", () => buildThreadStartParams(params.params, {
 		cwd: params.cwd,
 		dynamicTools: params.dynamicTools,
 		appServer: params.appServer,
@@ -1255,7 +1334,8 @@ async function startOrResumeThread(params) {
 		nativeCodeModeEnabled: params.nativeCodeModeEnabled,
 		nativeCodeModeOnlyEnabled: params.nativeCodeModeOnlyEnabled,
 		environmentSelection: params.environmentSelection
-	})));
+	}));
+	const response = assertCodexThreadStartResponse(await lifecycleTiming.measure("thread_start_request", () => params.client.request("thread/start", startParams)));
 	const modelProvider = resolveCodexAppServerModelProvider({
 		provider: params.params.provider,
 		authProfileId: params.params.authProfileId,
@@ -1266,7 +1346,7 @@ async function startOrResumeThread(params) {
 	const createdAt = (/* @__PURE__ */ new Date()).toISOString();
 	const nextMcpServersFingerprint = params.mcpServersFingerprintEvaluated === true ? params.mcpServersFingerprint : void 0;
 	if (!preserveExistingBinding) {
-		await writeCodexAppServerBinding(params.params.sessionFile, {
+		await lifecycleTiming.measure("thread_start_write_binding", () => writeCodexAppServerBinding(params.params.sessionFile, {
 			threadId: response.thread.id,
 			cwd: params.cwd,
 			authProfileId: params.params.authProfileId,
@@ -1285,7 +1365,7 @@ async function startOrResumeThread(params) {
 			authProfileStore: params.params.authProfileStore,
 			agentDir: params.params.agentDir,
 			config: params.params.config
-		});
+		}));
 		if (contextEngineBinding) embeddedAgentLog.info("codex app-server wrote context-engine thread binding", {
 			sessionId: params.params.sessionId,
 			sessionKey: params.params.sessionKey,
@@ -1296,6 +1376,13 @@ async function startOrResumeThread(params) {
 			action: rotatedContextEngineBinding ? "rotated" : "started"
 		});
 	}
+	lifecycleTiming.logIfSlow({
+		runId: params.params.runId,
+		sessionId: params.params.sessionId,
+		sessionKey: params.params.sessionKey,
+		threadId: response.thread.id,
+		action: rotatedContextEngineBinding ? "rotated" : "started"
+	});
 	return {
 		schemaVersion: 1,
 		threadId: response.thread.id,
@@ -1589,8 +1676,9 @@ function buildDeferredDynamicToolManifest(dynamicTools) {
 }
 function buildVisibleReplyInstruction(params, dynamicTools) {
 	const messageToolAvailable = dynamicTools ? dynamicTools.some((tool) => tool.name.trim() === "message") : params.disableMessageTool !== true;
-	if (params.sourceReplyDeliveryMode === "message_tool_only" && messageToolAvailable) return "To send a visible message, use the `message` tool.";
-	return "To send a visible reply, use the active Codex delivery path.";
+	if (params.sourceReplyDeliveryMode === "message_tool_only" && messageToolAvailable) return "Visible source replies are not automatically delivered for this run. Use `message(action=send)` for user-visible source-channel output. Do not repeat that visible content in your final answer.";
+	if (messageToolAvailable) return "For the current source conversation, reply normally in your final assistant message; OpenClaw will deliver it through the active source conversation. Use `message` only for explicit out-of-band sends, media/file sends, or sends to a different target.";
+	return "For the current source conversation, reply normally in your final assistant message; OpenClaw will deliver it through the active source conversation.";
 }
 function buildUserInput(params, promptText = params.prompt) {
 	const imageInputs = (params.images ?? []).map((image) => {
@@ -1623,4 +1711,4 @@ function resolveReasoningEffort(thinkLevel, modelId) {
 	return null;
 }
 //#endregion
-export { invalidInlineImageText as C, resolveCodexContextEngineProjectionMaxChars as D, projectContextEngineAssemblyForCodex as E, resolveCodexContextEngineProjectionReserveTokens as O, defaultCodexAppInventoryCache as S, sanitizeInlineImageDataUrl as T, mergeCodexThreadConfigs as _, buildDeveloperInstructions as a, pluginReadParams as b, buildTurnCollaborationMode as c, isContextEngineBindingCompatible as d, resolveCodexAppServerModelProvider as f, buildCodexPluginThreadConfigInputFingerprint as g, buildCodexPluginThreadConfig as h, buildContextEngineBinding as i, buildTurnStartParams as l, startOrResumeThread as m, areCodexDynamicToolFingerprintsCompatible as n, buildThreadResumeParams as o, resolveReasoningEffort as p, buildCodexRuntimeThreadConfig as r, buildThreadStartParams as s, CODEX_NATIVE_PERSONALITY_NONE as t, codexDynamicToolsFingerprint as u, shouldBuildCodexPluginThreadConfig as v, sanitizeCodexHistoryImagePayloads as w, buildCodexAppInventoryCacheKey as x, ensureCodexPluginActivation as y };
+export { defaultCodexAppInventoryCache as C, projectContextEngineAssemblyForCodex as D, sanitizeInlineImageDataUrl as E, resolveCodexContextEngineProjectionMaxChars as O, buildCodexAppInventoryCacheKey as S, sanitizeCodexHistoryImagePayloads as T, buildCodexPluginThreadConfigInputFingerprint as _, buildDeveloperInstructions as a, ensureCodexPluginActivation as b, buildTurnCollaborationMode as c, isContextEngineBindingCompatible as d, resolveCodexAppServerModelProvider as f, buildCodexPluginThreadConfig as g, isCodexAppServerProfilerEnabled as h, buildContextEngineBinding as i, resolveCodexContextEngineProjectionReserveTokens as k, buildTurnStartParams as l, startOrResumeThread as m, areCodexDynamicToolFingerprintsCompatible as n, buildThreadResumeParams as o, resolveReasoningEffort as p, buildCodexRuntimeThreadConfig as r, buildThreadStartParams as s, CODEX_NATIVE_PERSONALITY_NONE as t, codexDynamicToolsFingerprint as u, mergeCodexThreadConfigs as v, invalidInlineImageText as w, pluginReadParams as x, shouldBuildCodexPluginThreadConfig as y };

package/dist/{vision-tools-CETeQgze.js → vision-tools-DqpLmF5H.js}

@@ -1,5 +1,5 @@
-import { l as isJsonObject } from "./client-SrtuTTVa.js";
-import { s as formatCodexDisplayText } from "./notification-correlation-D7tJW3FW.js";
+import { l as isJsonObject } from "./client-BVK_jmHW.js";
+import { s as formatCodexDisplayText } from "./notification-correlation-YINts3PA.js";
 import { createHash } from "node:crypto";
 import { normalizeTrimmedStringList } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { buildAgentHookContextChannelFields, callGatewayTool, embeddedAgentLog, formatApprovalDisplayPath, hasNativeHookRelayInvocation, invokeNativeHookRelay, runBeforeToolCallHook } from "openclaw/plugin-sdk/agent-harness-runtime";
@@ -300,8 +300,10 @@ async function runNativeRelayToolPolicyForApprovalRequest(params) {
 		const decision = readNativeRelayPreToolUseDecision(await invokeNativeHookRelay({
 			provider: "codex",
 			relayId: params.nativeHookRelay.relayId,
+			generation: params.nativeHookRelay.generation,
 			event: "pre_tool_use",
-			rawPayload: payload
+			rawPayload: payload,
+			requireGeneration: true
 		}));
 		if (decision.blocked) return {
 			handled: true,