@openclaw/codex 2026.5.28 → 2026.5.30-beta.1

package/dist/{client-DMXvboVu.js → client-B08x7Y93.js}

@@ -367,6 +367,12 @@ var CodexAppServerClient = class CodexAppServerClient {
 		this.notificationHandlers.add(handler);
 		return () => this.notificationHandlers.delete(handler);
 	}
+	setActiveSharedLeaseCountProviderForUnscopedNotifications(provider) {
+		this.activeSharedLeaseCountProvider = provider;
+	}
+	getActiveSharedLeaseCountForUnscopedNotifications() {
+		return this.activeSharedLeaseCountProvider?.();
+	}
 	addCloseHandler(handler) {
 		this.closeHandlers.add(handler);
 		return () => this.closeHandlers.delete(handler);

package/dist/client-factory-bqIbmRDu.js

@@ -0,0 +1,20 @@
+//#region extensions/codex/src/app-server/client-factory.ts
+let sharedClientModulePromise = null;
+const loadSharedClientModule = async () => {
+	sharedClientModulePromise ??= import("./shared-client-2d0XB7wz.js").then((n) => n.s);
+	return await sharedClientModulePromise;
+};
+const defaultCodexAppServerClientFactory = (startOptions, authProfileId, agentDir, config) => loadSharedClientModule().then(({ getSharedCodexAppServerClient }) => getSharedCodexAppServerClient({
+	startOptions,
+	authProfileId,
+	agentDir,
+	config
+}));
+const defaultLeasedCodexAppServerClientFactory = (startOptions, authProfileId, agentDir, config) => loadSharedClientModule().then(({ getLeasedSharedCodexAppServerClient }) => getLeasedSharedCodexAppServerClient({
+	startOptions,
+	authProfileId,
+	agentDir,
+	config
+}));
+//#endregion
+export { defaultLeasedCodexAppServerClientFactory as n, defaultCodexAppServerClientFactory as t };

package/dist/{command-handlers-C2t6-ChO.js → command-handlers-VSWuNdgc.js}

@@ -1,20 +1,20 @@
 import { a as isCodexFastServiceTier, l as resolveCodexAppServerRuntimeOptions } from "./config--tW89bHH.js";
-import { n as listCodexAppServerModels, t as listAllCodexAppServerModels } from "./models-QT-XOhE7.js";
-import { l as isJsonObject } from "./client-DMXvboVu.js";
-import { i as readCodexAppServerBinding, o as writeCodexAppServerBinding, t as clearCodexAppServerBinding } from "./session-binding-ueMCn4om.js";
-import { i as describeControlFailure, r as CODEX_CONTROL_METHODS, t as requestCodexAppServerJson } from "./request-CF4f5hWY.js";
-import { a as buildHelp, c as formatCodexStatus, d as formatModels, f as formatSkills, l as formatComputerUseStatus, m as readString$1, o as formatAccount, p as formatThreads, s as formatCodexDisplayText, u as formatList, v as summarizeCodexAccountUsage } from "./notification-correlation-BDakP_d3.js";
-import { n as resolveCodexNativeExecutionBlock, r as resolveCodexNativeSandboxBlock } from "./sandbox-guard-mXE4_vE_.js";
-import { _ as steerCodexConversationTurn, b as readCodexConversationBindingData, d as parseCodexFastModeArg, f as parseCodexPermissionsModeArg, g as setCodexConversationPermissions, h as setCodexConversationModel, m as setCodexConversationFastMode, o as formatCodexCliSessions, p as readCodexConversationActiveTurn, r as startCodexConversationThread, u as formatPermissionsMode, v as stopCodexConversationTurn, x as resolveCodexDefaultWorkspaceDir, y as createCodexCliNodeConversationBindingData } from "./conversation-binding-CC9XMAwn.js";
-import { n as installCodexComputerUse, r as readCodexComputerUseStatus } from "./computer-use-Ba4vW9fO.js";
+import { n as listCodexAppServerModels, t as listAllCodexAppServerModels } from "./models-DuyStYTT.js";
+import { l as isJsonObject } from "./client-B08x7Y93.js";
+import { a as readCodexAppServerBinding, s as writeCodexAppServerBinding, t as clearCodexAppServerBinding } from "./session-binding-BGOpicy0.js";
+import { i as describeControlFailure, r as CODEX_CONTROL_METHODS, t as requestCodexAppServerJson } from "./request-DGOj3AyX.js";
+import { a as buildHelp, c as formatCodexStatus, d as formatModels, f as formatSkills, l as formatComputerUseStatus, m as readString$1, o as formatAccount, p as formatThreads, s as formatCodexDisplayText, u as formatList, v as summarizeCodexAccountUsage } from "./notification-correlation-DR9cQN_M.js";
+import { n as resolveCodexNativeExecutionBlock, r as resolveCodexNativeSandboxBlock } from "./sandbox-guard-DMCJlzmz.js";
+import { _ as steerCodexConversationTurn, b as readCodexConversationBindingData, d as parseCodexFastModeArg, f as parseCodexPermissionsModeArg, g as setCodexConversationPermissions, h as setCodexConversationModel, m as setCodexConversationFastMode, o as formatCodexCliSessions, p as readCodexConversationActiveTurn, r as startCodexConversationThread, u as formatPermissionsMode, v as stopCodexConversationTurn, x as resolveCodexDefaultWorkspaceDir, y as createCodexCliNodeConversationBindingData } from "./conversation-binding-DzF_JII7.js";
+import { n as installCodexComputerUse, r as readCodexComputerUseStatus } from "./computer-use-Cq-EEnLL.js";
 import { n as rememberCodexRateLimits } from "./rate-limit-cache-N66I-Rd7.js";
 import crypto from "node:crypto";
 import { normalizeOptionalString, normalizeUniqueStringEntries } from "openclaw/plugin-sdk/string-coerce-runtime";
-import { ensureAuthProfileStore, findNormalizedProviderValue, resolveAgentDir, resolveAuthProfileEligibility, resolveAuthProfileOrder, resolveDefaultAgentDir, resolveProfileUnusableUntilForDisplay, resolveSessionAgentIds } from "openclaw/plugin-sdk/agent-runtime";
 import { parseStrictPositiveInteger } from "openclaw/plugin-sdk/number-runtime";
+import { ensureAuthProfileStore, findNormalizedProviderValue, resolveAgentDir, resolveAuthProfileEligibility, resolveAuthProfileOrder, resolveDefaultAgentDir, resolveProfileUnusableUntilForDisplay, resolveSessionAgentIds } from "openclaw/plugin-sdk/agent-runtime";
 //#region extensions/codex/src/command-account.ts
 const OPENAI_PROVIDER_ID = "openai";
-const OPENAI_CODEX_PROVIDER_ID = "openai-codex";
+const OPENAI_CODEX_PROVIDER_ID = OPENAI_PROVIDER_ID;
 async function readCodexAccountAuthOverview(params) {
 	const config = params.ctx.config;
 	const store = ensureAuthProfileStore(resolveDefaultAgentDir(config), {

package/dist/{compact-Dlnt5G3v.js → compact-DJruF_vy.js}

@@ -1,7 +1,7 @@
-import { t as defaultCodexAppServerClientFactory } from "./client-factory-qZvhyyXr.js";
+import { t as defaultCodexAppServerClientFactory } from "./client-factory-bqIbmRDu.js";
 import { l as resolveCodexAppServerRuntimeOptions } from "./config--tW89bHH.js";
-import { i as readCodexAppServerBinding } from "./session-binding-ueMCn4om.js";
-import { n as resolveCodexNativeExecutionBlock } from "./sandbox-guard-mXE4_vE_.js";
+import { a as readCodexAppServerBinding } from "./session-binding-BGOpicy0.js";
+import { n as resolveCodexNativeExecutionBlock } from "./sandbox-guard-DMCJlzmz.js";
 import { embeddedAgentLog } from "openclaw/plugin-sdk/agent-harness-runtime";
 //#region extensions/codex/src/app-server/compact.ts
 const warnedIgnoredCompactionOverrides = /* @__PURE__ */ new Set();

package/dist/{computer-use-Ba4vW9fO.js → computer-use-Cq-EEnLL.js}

@@ -1,5 +1,5 @@
 import { l as resolveCodexAppServerRuntimeOptions, u as resolveCodexComputerUseConfig } from "./config--tW89bHH.js";
-import { i as describeControlFailure, t as requestCodexAppServerJson } from "./request-CF4f5hWY.js";
+import { i as describeControlFailure, t as requestCodexAppServerJson } from "./request-DGOj3AyX.js";
 import { existsSync } from "node:fs";
 //#region extensions/codex/src/app-server/computer-use.ts
 var CodexComputerUseSetupError = class extends Error {

package/dist/{conversation-binding-CC9XMAwn.js → conversation-binding-DzF_JII7.js}

@@ -1,17 +1,18 @@
 import { a as isCodexFastServiceTier, f as resolveOpenClawExecPolicyForCodexAppServer, l as resolveCodexAppServerRuntimeOptions, r as codexSandboxPolicyForTurn } from "./config--tW89bHH.js";
-import { l as isJsonObject } from "./client-DMXvboVu.js";
-import { t as CODEX_NATIVE_PERSONALITY_NONE } from "./thread-lifecycle-Dv9Npl7a.js";
-import { i as readCodexAppServerBinding, n as isCodexAppServerNativeAuthProfile, o as writeCodexAppServerBinding, r as normalizeCodexAppServerBindingModelProvider, t as clearCodexAppServerBinding } from "./session-binding-ueMCn4om.js";
-import { r as CODEX_CONTROL_METHODS } from "./request-CF4f5hWY.js";
-import { i as readCodexNotificationTurnId, r as readCodexNotificationThreadId, s as formatCodexDisplayText } from "./notification-correlation-BDakP_d3.js";
-import { a as releaseLeasedSharedCodexAppServerClient, f as resolveCodexAppServerAuthProfileIdForAgent, i as getLeasedSharedCodexAppServerClient } from "./shared-client-Duh1bHaP.js";
-import { n as resolveCodexNativeExecutionBlock, r as resolveCodexNativeSandboxBlock } from "./sandbox-guard-mXE4_vE_.js";
+import { l as isJsonObject } from "./client-B08x7Y93.js";
+import { t as CODEX_NATIVE_PERSONALITY_NONE } from "./thread-lifecycle-BR74qMaY.js";
+import { a as readCodexAppServerBinding, i as normalizeCodexAppServerBindingModelProvider, r as isCodexAppServerNativeAuthProfile, s as writeCodexAppServerBinding, t as clearCodexAppServerBinding } from "./session-binding-BGOpicy0.js";
+import { r as CODEX_CONTROL_METHODS } from "./request-DGOj3AyX.js";
+import { i as readCodexNotificationTurnId, r as readCodexNotificationThreadId, s as formatCodexDisplayText } from "./notification-correlation-DR9cQN_M.js";
+import { a as releaseLeasedSharedCodexAppServerClient, f as resolveCodexAppServerAuthProfileIdForAgent, i as getLeasedSharedCodexAppServerClient } from "./shared-client-2d0XB7wz.js";
+import { n as resolveCodexNativeExecutionBlock, r as resolveCodexNativeSandboxBlock } from "./sandbox-guard-DMCJlzmz.js";
 import os from "node:os";
 import { loadExecApprovals } from "openclaw/plugin-sdk/exec-approvals-runtime";
 import { asOptionalRecord, isRecord, normalizeSingleOrTrimmedStringList } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { materializeWindowsSpawnProgram, resolveWindowsSpawnProgram } from "openclaw/plugin-sdk/windows-spawn";
 import { formatErrorMessage, resolveSandboxContext } from "openclaw/plugin-sdk/agent-harness-runtime";
 import { spawn } from "node:child_process";
+import { timestampMsToIsoString } from "openclaw/plugin-sdk/number-runtime";
 import fs from "node:fs/promises";
 import path from "node:path";
 import { resolveSessionAgentIds as resolveSessionAgentIds$1 } from "openclaw/plugin-sdk/agent-runtime";
@@ -697,7 +698,7 @@ async function readHistorySessions(codexHome) {
 		};
 		entry.messageCount += 1;
 		if (typeof parsed.text === "string" && parsed.text.trim()) entry.lastMessage = truncateText(parsed.text.trim(), 140);
-		if (typeof parsed.ts === "number" && Number.isFinite(parsed.ts)) entry.updatedAt = (/* @__PURE__ */ new Date(parsed.ts * 1e3)).toISOString();
+		if (typeof parsed.ts === "number") entry.updatedAt = timestampMsToIsoString(parsed.ts * 1e3) ?? entry.updatedAt;
 		summaries.set(sessionId, entry);
 	}
 	return summaries;
@@ -1066,7 +1067,7 @@ async function handleCodexConversationBindingResolved(event) {
 	if (!data || data.kind !== "codex-app-server-session") return;
 	await clearCodexAppServerBinding(data.sessionFile);
 }
-async function attachExistingThread(params) {
+async function resolveThreadBindingRuntime(params) {
 	const { execPolicy, runtime } = await resolveConversationAppServerRuntime({
 		pluginConfig: params.pluginConfig,
 		config: params.config,
@@ -1078,103 +1079,79 @@ async function attachExistingThread(params) {
 		agentDir: params.agentDir,
 		config: params.config
 	});
-	const modelProvider = resolveThreadRequestModelProvider({
-		authProfileId: params.authProfileId,
-		modelProvider: params.modelProvider,
-		...agentLookup
-	});
-	const client = await getLeasedSharedCodexAppServerClient({
-		startOptions: runtime.start,
-		timeoutMs: runtime.requestTimeoutMs,
+	return {
+		execPolicy,
+		runtime,
+		agentLookup,
+		modelProvider: resolveThreadRequestModelProvider({
+			authProfileId: params.authProfileId,
+			modelProvider: params.modelProvider,
+			...agentLookup
+		}),
+		client: await getLeasedSharedCodexAppServerClient({
+			startOptions: runtime.start,
+			timeoutMs: runtime.requestTimeoutMs,
+			authProfileId: params.authProfileId,
+			...agentLookup
+		})
+	};
+}
+function buildThreadRequestRuntimeOptions(params, resolved) {
+	const serviceTier = params.serviceTier ?? resolved.runtime.serviceTier;
+	return {
+		approvalPolicy: resolved.execPolicy?.touched ? resolved.runtime.approvalPolicy : params.approvalPolicy ?? resolved.runtime.approvalPolicy,
+		approvalsReviewer: resolved.runtime.approvalsReviewer,
+		sandbox: resolved.execPolicy?.touched ? resolved.runtime.sandbox : params.sandbox ?? resolved.runtime.sandbox,
+		...serviceTier ? { serviceTier } : {}
+	};
+}
+async function writeThreadBindingFromResponse(params, resolved, response) {
+	const runtimeApprovalPolicy = typeof resolved.runtime.approvalPolicy === "string" ? resolved.runtime.approvalPolicy : void 0;
+	await writeCodexAppServerBinding(params.sessionFile, {
+		threadId: response.thread.id,
+		cwd: response.thread.cwd ?? params.workspaceDir,
 		authProfileId: params.authProfileId,
-		...agentLookup
-	});
+		model: response.model ?? params.model,
+		modelProvider: normalizeCodexAppServerBindingModelProvider({
+			authProfileId: params.authProfileId,
+			modelProvider: response.modelProvider ?? params.modelProvider,
+			...resolved.agentLookup
+		}),
+		approvalPolicy: resolved.execPolicy?.touched ? runtimeApprovalPolicy : params.approvalPolicy ?? runtimeApprovalPolicy,
+		sandbox: resolved.execPolicy?.touched ? resolved.runtime.sandbox : params.sandbox ?? resolved.runtime.sandbox,
+		serviceTier: params.serviceTier ?? resolved.runtime.serviceTier
+	}, { ...resolved.agentLookup });
+}
+async function attachExistingThread(params) {
+	const resolved = await resolveThreadBindingRuntime(params);
 	try {
-		const response = await client.request(CODEX_CONTROL_METHODS.resumeThread, {
+		await writeThreadBindingFromResponse(params, resolved, await resolved.client.request(CODEX_CONTROL_METHODS.resumeThread, {
 			threadId: params.threadId,
 			...params.model ? { model: params.model } : {},
-			...modelProvider ? { modelProvider } : {},
+			...resolved.modelProvider ? { modelProvider: resolved.modelProvider } : {},
 			personality: CODEX_NATIVE_PERSONALITY_NONE,
-			approvalPolicy: execPolicy?.touched ? runtime.approvalPolicy : params.approvalPolicy ?? runtime.approvalPolicy,
-			approvalsReviewer: runtime.approvalsReviewer,
-			sandbox: execPolicy?.touched ? runtime.sandbox : params.sandbox ?? runtime.sandbox,
-			...params.serviceTier ?? runtime.serviceTier ? { serviceTier: params.serviceTier ?? runtime.serviceTier } : {},
+			...buildThreadRequestRuntimeOptions(params, resolved),
 			persistExtendedHistory: true
-		}, { timeoutMs: runtime.requestTimeoutMs });
-		const thread = response.thread;
-		const runtimeApprovalPolicy = typeof runtime.approvalPolicy === "string" ? runtime.approvalPolicy : void 0;
-		await writeCodexAppServerBinding(params.sessionFile, {
-			threadId: thread.id,
-			cwd: thread.cwd ?? params.workspaceDir,
-			authProfileId: params.authProfileId,
-			model: response.model ?? params.model,
-			modelProvider: normalizeCodexAppServerBindingModelProvider({
-				authProfileId: params.authProfileId,
-				modelProvider: response.modelProvider ?? params.modelProvider,
-				...agentLookup
-			}),
-			approvalPolicy: execPolicy?.touched ? runtimeApprovalPolicy : params.approvalPolicy ?? runtimeApprovalPolicy,
-			sandbox: execPolicy?.touched ? runtime.sandbox : params.sandbox ?? runtime.sandbox,
-			serviceTier: params.serviceTier ?? runtime.serviceTier
-		}, { ...agentLookup });
+		}, { timeoutMs: resolved.runtime.requestTimeoutMs }));
 	} finally {
-		releaseLeasedSharedCodexAppServerClient(client);
+		releaseLeasedSharedCodexAppServerClient(resolved.client);
 	}
 }
 async function createThread(params) {
-	const { execPolicy, runtime } = await resolveConversationAppServerRuntime({
-		pluginConfig: params.pluginConfig,
-		config: params.config,
-		agentId: params.agentId,
-		sessionKey: params.sessionKey,
-		workspaceDir: params.workspaceDir
-	});
-	const agentLookup = buildAgentLookup({
-		agentDir: params.agentDir,
-		config: params.config
-	});
-	const modelProvider = resolveThreadRequestModelProvider({
-		authProfileId: params.authProfileId,
-		modelProvider: params.modelProvider,
-		...agentLookup
-	});
-	const client = await getLeasedSharedCodexAppServerClient({
-		startOptions: runtime.start,
-		timeoutMs: runtime.requestTimeoutMs,
-		authProfileId: params.authProfileId,
-		...agentLookup
-	});
+	const resolved = await resolveThreadBindingRuntime(params);
 	try {
-		const response = await client.request("thread/start", {
+		await writeThreadBindingFromResponse(params, resolved, await resolved.client.request("thread/start", {
 			cwd: params.workspaceDir,
 			...params.model ? { model: params.model } : {},
-			...modelProvider ? { modelProvider } : {},
+			...resolved.modelProvider ? { modelProvider: resolved.modelProvider } : {},
 			personality: CODEX_NATIVE_PERSONALITY_NONE,
-			approvalPolicy: execPolicy?.touched ? runtime.approvalPolicy : params.approvalPolicy ?? runtime.approvalPolicy,
-			approvalsReviewer: runtime.approvalsReviewer,
-			sandbox: execPolicy?.touched ? runtime.sandbox : params.sandbox ?? runtime.sandbox,
-			...params.serviceTier ?? runtime.serviceTier ? { serviceTier: params.serviceTier ?? runtime.serviceTier } : {},
+			...buildThreadRequestRuntimeOptions(params, resolved),
 			developerInstructions: "This Codex thread is bound to an OpenClaw conversation. Answer normally; OpenClaw will deliver your final response back to the conversation.",
 			experimentalRawEvents: true,
 			persistExtendedHistory: true
-		}, { timeoutMs: runtime.requestTimeoutMs });
-		const runtimeApprovalPolicy = typeof runtime.approvalPolicy === "string" ? runtime.approvalPolicy : void 0;
-		await writeCodexAppServerBinding(params.sessionFile, {
-			threadId: response.thread.id,
-			cwd: response.thread.cwd ?? params.workspaceDir,
-			authProfileId: params.authProfileId,
-			model: response.model ?? params.model,
-			modelProvider: normalizeCodexAppServerBindingModelProvider({
-				authProfileId: params.authProfileId,
-				modelProvider: response.modelProvider ?? params.modelProvider,
-				...agentLookup
-			}),
-			approvalPolicy: execPolicy?.touched ? runtimeApprovalPolicy : params.approvalPolicy ?? runtimeApprovalPolicy,
-			sandbox: execPolicy?.touched ? runtime.sandbox : params.sandbox ?? runtime.sandbox,
-			serviceTier: params.serviceTier ?? runtime.serviceTier
-		}, { ...agentLookup });
+		}, { timeoutMs: resolved.runtime.requestTimeoutMs }));
 	} finally {
-		releaseLeasedSharedCodexAppServerClient(client);
+		releaseLeasedSharedCodexAppServerClient(resolved.client);
 	}
 }
 async function runBoundTurn(params) {
@@ -1333,8 +1310,8 @@ function enqueueBoundTurn(key, run) {
 function resolveThreadRequestModelProvider(params) {
 	const modelProvider = params.modelProvider?.trim();
 	if (!modelProvider || modelProvider.toLowerCase() === "codex") return;
-	if (isCodexAppServerNativeAuthProfile(params) && (modelProvider.toLowerCase() === "openai" || modelProvider.toLowerCase() === "openai-codex")) return;
-	return modelProvider.toLowerCase() === "openai-codex" ? "openai" : modelProvider;
+	if (isCodexAppServerNativeAuthProfile(params) && modelProvider.toLowerCase() === "openai") return;
+	return modelProvider.toLowerCase() === "openai" ? "openai" : modelProvider;
 }
 function buildAgentLookup(params) {
 	const agentDir = params.agentDir?.trim();

package/dist/harness.js

@@ -1,9 +1,5 @@
 //#region extensions/codex/harness.ts
-const DEFAULT_CODEX_HARNESS_PROVIDER_IDS = new Set([
-	"codex",
-	"openai-codex",
-	"openai"
-]);
+const DEFAULT_CODEX_HARNESS_PROVIDER_IDS = new Set(["codex", "openai"]);
 const CODEX_APP_SERVER_CONTEXT_ENGINE_HOST_CAPABILITIES = [
 	"bootstrap",
 	"assemble-before-prompt",
@@ -32,31 +28,31 @@ function createCodexAppServerAgentHarness(options) {
 			};
 		},
 		runAttempt: async (params) => {
-			const { runCodexAppServerAttempt } = await import("./run-attempt-CuhGEh0u.js");
+			const { runCodexAppServerAttempt } = await import("./run-attempt-lD4FLxNV.js");
 			return runCodexAppServerAttempt(params, {
 				pluginConfig: options?.resolvePluginConfig?.() ?? options?.pluginConfig,
 				nativeHookRelay: { enabled: true }
 			});
 		},
 		runSideQuestion: async (params) => {
-			const { runCodexAppServerSideQuestion } = await import("./side-question-B-Cjb9wm.js");
+			const { runCodexAppServerSideQuestion } = await import("./side-question-BsyY3v3K.js");
 			return runCodexAppServerSideQuestion(params, {
 				pluginConfig: options?.resolvePluginConfig?.() ?? options?.pluginConfig,
 				nativeHookRelay: { enabled: true }
 			});
 		},
 		compact: async (params) => {
-			const { maybeCompactCodexAppServerSession } = await import("./compact-Dlnt5G3v.js");
+			const { maybeCompactCodexAppServerSession } = await import("./compact-DJruF_vy.js");
 			return maybeCompactCodexAppServerSession(params, { pluginConfig: options?.resolvePluginConfig?.() ?? options?.pluginConfig });
 		},
 		reset: async (params) => {
 			if (params.sessionFile) {
-				const { clearCodexAppServerBinding } = await import("./session-binding-ueMCn4om.js").then((n) => n.a);
+				const { clearCodexAppServerBinding } = await import("./session-binding-BGOpicy0.js").then((n) => n.o);
 				await clearCodexAppServerBinding(params.sessionFile);
 			}
 		},
 		dispose: async () => {
-			const { clearSharedCodexAppServerClientAndWait } = await import("./shared-client-Duh1bHaP.js").then((n) => n.s);
+			const { clearSharedCodexAppServerClientAndWait } = await import("./shared-client-2d0XB7wz.js").then((n) => n.s);
 			await clearSharedCodexAppServerClientAndWait();
 		}
 	};

package/dist/index.js

@@ -1,25 +1,25 @@
 import { createCodexAppServerAgentHarness } from "./harness.js";
 import { c as readCodexPluginConfig, l as resolveCodexAppServerRuntimeOptions, t as CODEX_PLUGINS_MARKETPLACE_NAME } from "./config--tW89bHH.js";
 import { buildCodexProvider } from "./provider.js";
-import { v as ensureCodexPluginActivation, x as defaultCodexAppInventoryCache, y as pluginReadParams } from "./thread-lifecycle-Dv9Npl7a.js";
+import { v as ensureCodexPluginActivation, x as defaultCodexAppInventoryCache, y as pluginReadParams } from "./thread-lifecycle-BR74qMaY.js";
 import { buildCodexMediaUnderstandingProvider } from "./media-understanding-provider.js";
-import { i as describeControlFailure, n as buildCodexPluginAppCacheKey, t as requestCodexAppServerJson } from "./request-CF4f5hWY.js";
-import { s as formatCodexDisplayText } from "./notification-correlation-BDakP_d3.js";
-import { a as releaseLeasedSharedCodexAppServerClient, f as resolveCodexAppServerAuthProfileIdForAgent, i as getLeasedSharedCodexAppServerClient, n as clearSharedCodexAppServerClientIfCurrentAndWait, p as resolveCodexAppServerFallbackApiKeyCacheKey, u as resolveCodexAppServerAuthAccountCacheKey } from "./shared-client-Duh1bHaP.js";
-import { a as createCodexCliSessionNodeInvokePolicies, c as resolveCodexCliSessionForBindingOnNode, i as createCodexCliSessionNodeHostCommands, l as resumeCodexCliSessionOnNode, n as handleCodexConversationInboundClaim, s as listCodexCliSessionsOnNode, t as handleCodexConversationBindingResolved } from "./conversation-binding-CC9XMAwn.js";
+import { i as describeControlFailure, n as buildCodexPluginAppCacheKey, t as requestCodexAppServerJson } from "./request-DGOj3AyX.js";
+import { s as formatCodexDisplayText } from "./notification-correlation-DR9cQN_M.js";
+import { a as releaseLeasedSharedCodexAppServerClient, f as resolveCodexAppServerAuthProfileIdForAgent, i as getLeasedSharedCodexAppServerClient, n as clearSharedCodexAppServerClientIfCurrentAndWait, p as resolveCodexAppServerFallbackApiKeyCacheKey, u as resolveCodexAppServerAuthAccountCacheKey } from "./shared-client-2d0XB7wz.js";
+import { a as createCodexCliSessionNodeInvokePolicies, c as resolveCodexCliSessionForBindingOnNode, i as createCodexCliSessionNodeHostCommands, l as resumeCodexCliSessionOnNode, n as handleCodexConversationInboundClaim, s as listCodexCliSessionsOnNode, t as handleCodexConversationBindingResolved } from "./conversation-binding-DzF_JII7.js";
 import { mutateConfigFile } from "openclaw/plugin-sdk/config-mutation";
 import { resolveLivePluginConfigObject } from "openclaw/plugin-sdk/plugin-config-runtime";
 import { definePluginEntry } from "openclaw/plugin-sdk/plugin-entry";
 import os from "node:os";
 import { asBoolean, isRecord, normalizeOptionalString, uniqueStrings } from "openclaw/plugin-sdk/string-coerce-runtime";
+import { parseStrictNonNegativeInteger } from "openclaw/plugin-sdk/number-runtime";
 import fs from "node:fs/promises";
 import path from "node:path";
 import { loadAuthProfileStoreWithoutExternalProfiles, resolveAgentConfig, resolveAgentWorkspaceDir, resolveDefaultAgentId } from "openclaw/plugin-sdk/agent-runtime";
 import { pathExists } from "openclaw/plugin-sdk/security-runtime";
 import { MIGRATION_REASON_TARGET_EXISTS, applyMigrationManualItem, createMigrationItem, createMigrationManualItem, hasMigrationConfigPatchConflict, markMigrationItemConflict, markMigrationItemError, markMigrationItemSkipped, readMigrationConfigPath, summarizeMigrationItems, writeMigrationConfigPath } from "openclaw/plugin-sdk/migration";
 import { archiveMigrationItem, copyMigrationFileItem, withCachedMigrationConfigRuntime, writeMigrationReport } from "openclaw/plugin-sdk/migration-runtime";
-import { parseStrictNonNegativeInteger } from "openclaw/plugin-sdk/number-runtime";
-import { applyAuthProfileConfig, buildApiKeyCredential, buildOauthProviderAuthResult, readCodexCliCredentialsCached, updateAuthProfileStoreWithLock } from "openclaw/plugin-sdk/provider-auth";
+import { applyAuthProfileConfig, buildApiKeyCredential, buildOauthProviderAuthResult, buildOpenAICodexCredentialExtra, readCodexCliCredentialsCached, resolveOpenAICodexAuthIdentity, resolveOpenAICodexImportProfileName, updateAuthProfileStoreWithLock } from "openclaw/plugin-sdk/provider-auth";
 import { readJsonFileWithFallback } from "openclaw/plugin-sdk/json-store";
 //#region extensions/codex/src/commands.ts
 function createCodexCommand(options) {
@@ -48,7 +48,7 @@ async function handleCodexCommand(ctx, options = {}) {
 	}
 }
 async function loadDefaultCodexSubcommandHandler() {
-	const { handleCodexSubcommand } = await import("./command-handlers-C2t6-ChO.js");
+	const { handleCodexSubcommand } = await import("./command-handlers-VSWuNdgc.js");
 	return handleCodexSubcommand;
 }
 //#endregion
@@ -82,7 +82,6 @@ async function readJsonObject(filePath) {
 }
 //#endregion
 //#region extensions/codex/src/migration/auth.ts
-const OPENAI_CODEX_PROVIDER_ID = "openai-codex";
 const OPENAI_PROVIDER_ID = "openai";
 const OPENAI_CODEX_DEFAULT_MODEL = "openai/gpt-5.5";
 const CODEX_IMPORT_DISPLAY_NAME = "Codex import";
@@ -93,48 +92,6 @@ const CODEX_REASON_AUTH_NO_LONGER_PRESENT = "auth credential no longer present";
 const CODEX_REASON_MISSING_AUTH_METADATA = "missing auth metadata";
 const CODEX_CONFIG_PATCH_MODE_RETURN$1 = "return";
 var CodexAuthConfigConflict = class extends Error {};
-function decodeJwtPayload(token) {
-	const payload = token.split(".")[1];
-	if (!payload) return;
-	try {
-		const parsed = JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
-		return isRecord(parsed) ? parsed : void 0;
-	} catch {
-		return;
-	}
-}
-function resolveCodexIdentity(access, accountId) {
-	const payload = decodeJwtPayload(access);
-	const auth = isRecord(payload?.["https://api.openai.com/auth"]) ? payload["https://api.openai.com/auth"] : {};
-	const email = normalizeOptionalString((isRecord(payload?.["https://api.openai.com/profile"]) ? payload["https://api.openai.com/profile"] : {}).email);
-	const resolvedAccountId = accountId ?? normalizeOptionalString(auth.chatgpt_account_id);
-	const chatgptPlanType = normalizeOptionalString(auth.chatgpt_plan_type);
-	if (email) return {
-		...resolvedAccountId ? { accountId: resolvedAccountId } : {},
-		...chatgptPlanType ? { chatgptPlanType } : {},
-		email,
-		profileName: email
-	};
-	const stableSubject = normalizeOptionalString(auth.chatgpt_account_user_id) ?? normalizeOptionalString(auth.chatgpt_user_id) ?? normalizeOptionalString(auth.user_id) ?? normalizeOptionalString(payload?.sub) ?? resolvedAccountId;
-	return {
-		...resolvedAccountId ? { accountId: resolvedAccountId } : {},
-		...chatgptPlanType ? { chatgptPlanType } : {},
-		...stableSubject ? { profileName: `id-${Buffer.from(stableSubject).toString("base64url")}` } : {}
-	};
-}
-function credentialExtra(identity) {
-	const extra = {
-		...identity.accountId ? { accountId: identity.accountId } : {},
-		...identity.chatgptPlanType ? { chatgptPlanType: identity.chatgptPlanType } : {},
-		...identity.idToken ? { idToken: identity.idToken } : {}
-	};
-	return Object.keys(extra).length > 0 ? extra : void 0;
-}
-function importProfileName(identity, fallback) {
-	if (identity.accountId) return `account-${identity.accountId.replaceAll(/[^A-Za-z0-9._-]+/gu, "-")}`;
-	if (identity.profileName?.startsWith("id-")) return identity.profileName;
-	return fallback;
-}
 async function readModelRefs(source) {
 	const cache = await readJsonObject(source.modelsCachePath);
 	const models = Array.isArray(cache.models) ? cache.models : [];
@@ -159,19 +116,22 @@ async function buildCodexOAuthCredential(source) {
 		ttlMs: 0
 	});
 	if (!credential) return null;
-	const identity = resolveCodexIdentity(credential.access, credential.accountId);
+	const identity = resolveOpenAICodexAuthIdentity({
+		access: credential.access,
+		accountId: credential.accountId
+	});
 	const modelRefs = await readModelRefs(source);
 	const configPatch = { agents: { defaults: { models: Object.fromEntries(modelRefs.map((modelRef) => [modelRef, {}])) } } };
 	const result = buildOauthProviderAuthResult({
-		providerId: OPENAI_CODEX_PROVIDER_ID,
+		providerId: OPENAI_PROVIDER_ID,
 		defaultModel: OPENAI_CODEX_DEFAULT_MODEL,
 		access: credential.access,
 		refresh: credential.refresh,
 		expires: credential.expires,
 		email: identity.email,
-		profileName: importProfileName(identity, "codex-import"),
+		profileName: resolveOpenAICodexImportProfileName(identity, "codex-import"),
 		displayName: CODEX_IMPORT_DISPLAY_NAME,
-		credentialExtra: credentialExtra({
+		credentialExtra: buildOpenAICodexCredentialExtra({
 			accountId: identity.accountId,
 			chatgptPlanType: identity.chatgptPlanType,
 			idToken: credential.idToken
@@ -181,7 +141,7 @@ async function buildCodexOAuthCredential(source) {
 	const profile = result.profiles[0];
 	return profile ? {
 		kind: "oauth",
-		provider: OPENAI_CODEX_PROVIDER_ID,
+		provider: OPENAI_PROVIDER_ID,
 		profileId: profile.profileId,
 		result,
 		modelConfigs: readProviderAuthModelConfigs(result)

package/dist/media-understanding-provider.js

@@ -1,10 +1,10 @@
 import { CODEX_PROVIDER_ID, FALLBACK_CODEX_MODELS } from "./provider-catalog.js";
-import "./client-factory-qZvhyyXr.js";
+import "./client-factory-bqIbmRDu.js";
 import { l as resolveCodexAppServerRuntimeOptions } from "./config--tW89bHH.js";
 import { i as assertCodexTurnStartResponse, l as readCodexTurnCompletedNotification, o as readCodexErrorNotification, r as assertCodexThreadStartResponse } from "./protocol-validators-DtjYmUw_.js";
-import { i as readModelListResult } from "./models-QT-XOhE7.js";
-import { l as isJsonObject } from "./client-DMXvboVu.js";
-import { r as buildCodexRuntimeThreadConfig } from "./thread-lifecycle-Dv9Npl7a.js";
+import { i as readModelListResult } from "./models-DuyStYTT.js";
+import { l as isJsonObject } from "./client-B08x7Y93.js";
+import { r as buildCodexRuntimeThreadConfig } from "./thread-lifecycle-BR74qMaY.js";
 import { validateJsonSchemaValue } from "openclaw/plugin-sdk/json-schema-runtime";
 import "openclaw/plugin-sdk/media-understanding";
 //#region extensions/codex/media-understanding-provider.ts
@@ -65,7 +65,7 @@ async function runBoundedCodexVisionTurn(params) {
 	const appServer = resolveCodexAppServerRuntimeOptions({ pluginConfig: params.options.pluginConfig });
 	const timeoutMs = Math.max(100, params.timeoutMs);
 	const ownsClient = !params.options.clientFactory;
-	const client = params.options.clientFactory ? await params.options.clientFactory(appServer.start, params.profile) : await import("./shared-client-Duh1bHaP.js").then((n) => n.s).then(({ createIsolatedCodexAppServerClient }) => createIsolatedCodexAppServerClient({
+	const client = params.options.clientFactory ? await params.options.clientFactory(appServer.start, params.profile) : await import("./shared-client-2d0XB7wz.js").then((n) => n.s).then(({ createIsolatedCodexAppServerClient }) => createIsolatedCodexAppServerClient({
 		startOptions: appServer.start,
 		timeoutMs,
 		authProfileId: params.profile

package/dist/{models-QT-XOhE7.js → models-DuyStYTT.js}

@@ -40,7 +40,7 @@ async function listAllCodexAppServerModels(options = {}) {
 async function withCodexAppServerModelClient(options, run) {
 	const timeoutMs = options.timeoutMs ?? 2500;
 	const useSharedClient = options.sharedClient !== false;
-	const { createIsolatedCodexAppServerClient, getLeasedSharedCodexAppServerClient, releaseLeasedSharedCodexAppServerClient } = await import("./shared-client-Duh1bHaP.js").then((n) => n.s);
+	const { createIsolatedCodexAppServerClient, getLeasedSharedCodexAppServerClient, releaseLeasedSharedCodexAppServerClient } = await import("./shared-client-2d0XB7wz.js").then((n) => n.s);
 	const client = useSharedClient ? await getLeasedSharedCodexAppServerClient({
 		startOptions: options.startOptions,
 		timeoutMs,

package/dist/{native-hook-relay-B8qM8ZwR.js → native-hook-relay-zY7m-pAu.js}

@@ -1,18 +1,86 @@
-import { l as isJsonObject } from "./client-DMXvboVu.js";
-import { S as invalidInlineImageText, w as sanitizeInlineImageDataUrl } from "./thread-lifecycle-Dv9Npl7a.js";
-import { s as formatCodexDisplayText } from "./notification-correlation-BDakP_d3.js";
+import { l as isJsonObject } from "./client-B08x7Y93.js";
+import { S as invalidInlineImageText, w as sanitizeInlineImageDataUrl } from "./thread-lifecycle-BR74qMaY.js";
+import { s as formatCodexDisplayText } from "./notification-correlation-DR9cQN_M.js";
 import { createHash } from "node:crypto";
 import { normalizeAgentId } from "openclaw/plugin-sdk/routing";
 import { asOptionalRecord, isRecord, normalizeTrimmedStringList } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { HEARTBEAT_RESPONSE_TOOL_NAME, buildAgentHookContextChannelFields, callGatewayTool, createAgentToolResultMiddlewareRunner, createCodexAppServerToolResultExtensionRunner, embeddedAgentLog, extractToolResultMediaArtifact, filterToolResultMediaUrls, formatApprovalDisplayPath, hasNativeHookRelayInvocation, invokeNativeHookRelay, isMessagingTool, isMessagingToolSendAction, isToolWrappedWithBeforeToolCallHook, normalizeHeartbeatToolResponse, projectRuntimeToolInputSchema, registerNativeHookRelay, resolveNativeHookRelayDeferredToolApproval, runAgentHarnessAfterToolCallHook, runBeforeToolCallHook, setBeforeToolCallDiagnosticsEnabled, wrapToolWithBeforeToolCallHook } from "openclaw/plugin-sdk/agent-harness-runtime";
+import { addTimerTimeoutGraceMs, resolveTimerTimeoutMs } from "openclaw/plugin-sdk/number-runtime";
 import { emitTrustedDiagnosticEvent } from "openclaw/plugin-sdk/diagnostic-runtime";
+const CODEX_TURN_COMPLETION_IDLE_TIMEOUT_MS = 6e4;
+const CODEX_TURN_ASSISTANT_COMPLETION_IDLE_TIMEOUT_MS = 1e4;
+const CODEX_POST_TOOL_RAW_ASSISTANT_COMPLETION_IDLE_TIMEOUT_MS = 5 * 6e4;
+const CODEX_POST_REASONING_REPLY_IDLE_TIMEOUT_MS = 5 * 6e4;
+const CODEX_TURN_TERMINAL_IDLE_TIMEOUT_MS = 30 * 6e4;
+function resolvePositiveIntegerTimeoutMs(value, fallbackMs) {
+	return resolveTimerTimeoutMs(value, resolveTimerTimeoutMs(fallbackMs, 1));
+}
+async function withCodexStartupTimeout(params) {
+	if (params.signal.aborted) throw new Error("codex app-server startup aborted");
+	let timeout;
+	let abortCleanup;
+	let timeoutError;
+	let timeoutCleanup;
+	try {
+		return await Promise.race([params.operation(), new Promise((_, reject) => {
+			const rejectOnce = (error) => {
+				if (timeout) {
+					clearTimeout(timeout);
+					timeout = void 0;
+				}
+				reject(error);
+			};
+			timeout = setTimeout(() => {
+				timeoutError = /* @__PURE__ */ new Error("codex app-server startup timed out");
+				timeoutCleanup = Promise.resolve(params.onTimeout?.()).then(() => void 0, () => void 0);
+				timeoutCleanup.finally(() => {
+					rejectOnce(timeoutError);
+				});
+			}, params.timeoutMs);
+			const abortListener = () => rejectOnce(/* @__PURE__ */ new Error("codex app-server startup aborted"));
+			params.signal.addEventListener("abort", abortListener, { once: true });
+			abortCleanup = () => params.signal.removeEventListener("abort", abortListener);
+		})]);
+	} catch (error) {
+		if (timeoutError) {
+			await timeoutCleanup;
+			throw timeoutError;
+		}
+		throw error;
+	} finally {
+		if (timeout) clearTimeout(timeout);
+		abortCleanup?.();
+	}
+}
+function resolveCodexStartupTimeoutMs(params) {
+	const timeoutFloorMs = resolvePositiveIntegerTimeoutMs(params.timeoutFloorMs, 100);
+	const timeoutMs = resolvePositiveIntegerTimeoutMs(params.timeoutMs, timeoutFloorMs);
+	return Math.max(timeoutFloorMs, timeoutMs);
+}
+function resolveCodexTurnCompletionIdleTimeoutMs(value) {
+	return resolvePositiveIntegerTimeoutMs(value, CODEX_TURN_COMPLETION_IDLE_TIMEOUT_MS);
+}
+function resolveCodexTurnAssistantCompletionIdleTimeoutMs(value) {
+	return resolvePositiveIntegerTimeoutMs(value, CODEX_TURN_ASSISTANT_COMPLETION_IDLE_TIMEOUT_MS);
+}
+function resolveCodexPostToolRawAssistantCompletionIdleTimeoutMs(value, fallbackMs) {
+	return resolvePositiveIntegerTimeoutMs(value, Math.max(resolvePositiveIntegerTimeoutMs(void 0, fallbackMs), CODEX_POST_TOOL_RAW_ASSISTANT_COMPLETION_IDLE_TIMEOUT_MS));
+}
+function resolveCodexTurnTerminalIdleTimeoutMs(value) {
+	return resolvePositiveIntegerTimeoutMs(value, CODEX_TURN_TERMINAL_IDLE_TIMEOUT_MS);
+}
+function resolveCodexGatewayTimeoutWithGraceMs(timeoutMs, graceMs = 1e4) {
+	const timeout = resolvePositiveIntegerTimeoutMs(timeoutMs, 1);
+	return addTimerTimeoutGraceMs(timeout, resolveTimerTimeoutMs(graceMs, 0, 0)) ?? timeout;
+}
+//#endregion
 //#region extensions/codex/src/app-server/plugin-approval-roundtrip.ts
 const DEFAULT_CODEX_APPROVAL_TIMEOUT_MS = 12e4;
 const MAX_PLUGIN_APPROVAL_TITLE_LENGTH = 80;
 const MAX_PLUGIN_APPROVAL_DESCRIPTION_LENGTH = 256;
 async function requestPluginApproval(params) {
 	const timeoutMs = DEFAULT_CODEX_APPROVAL_TIMEOUT_MS;
-	return callGatewayTool("plugin.approval.request", { timeoutMs: 13e4 }, {
+	return callGatewayTool("plugin.approval.request", { timeoutMs: resolveCodexGatewayTimeoutWithGraceMs(timeoutMs) }, {
 		pluginId: "openclaw-codex-app-server",
 		title: truncateForGateway(params.title, MAX_PLUGIN_APPROVAL_TITLE_LENGTH),
 		description: truncateForGateway(params.description, MAX_PLUGIN_APPROVAL_DESCRIPTION_LENGTH),
@@ -40,7 +108,7 @@ function approvalRequestExplicitlyUnavailable(result) {
 	return descriptor !== void 0 && "value" in descriptor && descriptor.value === null;
 }
 async function waitForPluginApprovalDecision(params) {
-	const waitPromise = callGatewayTool("plugin.approval.waitDecision", { timeoutMs: 13e4 }, { id: params.approvalId });
+	const waitPromise = callGatewayTool("plugin.approval.waitDecision", { timeoutMs: resolveCodexGatewayTimeoutWithGraceMs(DEFAULT_CODEX_APPROVAL_TIMEOUT_MS) }, { id: params.approvalId });
 	if (!params.signal) return (await waitPromise)?.decision;
 	let onAbort;
 	const abortPromise = new Promise((_, reject) => {
@@ -2091,4 +2159,4 @@ function sortJsonValue(value) {
 	return sorted;
 }
 //#endregion
-export { normalizeCodexDynamicToolName as _, createCodexNativeHookRelay as a, scheduleCodexNativeHookRelayUnregister as c, emitDynamicToolErrorDiagnostic as d, emitDynamicToolStartedDiagnostic as f, isForcedPrivateQaCodexRuntime as g, filterCodexDynamicTools as h, buildCodexNativeHookRelayDisabledConfig as i, handleCodexAppServerElicitationRequest as l, filterToolsForVisionInputs as m, CODEX_NATIVE_HOOK_RELAY_TTL_GRACE_MS as n, resolveCodexNativeHookRelayEvents as o, emitDynamicToolTerminalDiagnostic as p, buildCodexNativeHookRelayConfig as r, resolveCodexNativeHookRelayTtlMs as s, CODEX_NATIVE_HOOK_RELAY_EVENTS as t, createCodexDynamicToolBridge as u, resolveCodexDynamicToolsLoading as v, handleCodexAppServerApprovalRequest as y };
+export { resolveCodexTurnAssistantCompletionIdleTimeoutMs as C, withCodexStartupTimeout as E, resolveCodexStartupTimeoutMs as S, resolveCodexTurnTerminalIdleTimeoutMs as T, normalizeCodexDynamicToolName as _, createCodexNativeHookRelay as a, CODEX_POST_REASONING_REPLY_IDLE_TIMEOUT_MS as b, scheduleCodexNativeHookRelayUnregister as c, emitDynamicToolErrorDiagnostic as d, emitDynamicToolStartedDiagnostic as f, isForcedPrivateQaCodexRuntime as g, filterCodexDynamicTools as h, buildCodexNativeHookRelayDisabledConfig as i, handleCodexAppServerElicitationRequest as l, filterToolsForVisionInputs as m, CODEX_NATIVE_HOOK_RELAY_TTL_GRACE_MS as n, resolveCodexNativeHookRelayEvents as o, emitDynamicToolTerminalDiagnostic as p, buildCodexNativeHookRelayConfig as r, resolveCodexNativeHookRelayTtlMs as s, CODEX_NATIVE_HOOK_RELAY_EVENTS as t, createCodexDynamicToolBridge as u, resolveCodexDynamicToolsLoading as v, resolveCodexTurnCompletionIdleTimeoutMs as w, resolveCodexPostToolRawAssistantCompletionIdleTimeoutMs as x, handleCodexAppServerApprovalRequest as y };