@openclaw/codex 2026.5.28 → 2026.5.31-beta.1

package/dist/{sandbox-guard-mXE4_vE_.js → sandbox-guard-DMCJlzmz.js}

@@ -92,7 +92,10 @@ function resolveEffectiveExecHost(params) {
 }
 function readRuntimeSessionEntryBestEffort(sessionKey) {
 	try {
-		return getSessionEntry({ sessionKey });
+		return getSessionEntry({
+			sessionKey,
+			hydrateSkillPromptRefs: false
+		});
 	} catch {
 		return;
 	}

package/dist/{session-binding-ueMCn4om.js → session-binding-BXJAV_xy.js}

@@ -1,18 +1,19 @@
 import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
-import { s as normalizeCodexServiceTier } from "./config--tW89bHH.js";
+import { l as normalizeCodexServiceTier, s as isCodexPluginsMarketplaceName } from "./config-AlzuNKCY.js";
 import { embeddedAgentLog } from "openclaw/plugin-sdk/agent-harness-runtime";
 import fs from "node:fs/promises";
 import { ensureAuthProfileStore, resolveDefaultAgentDir, resolveProviderIdForAuth } from "openclaw/plugin-sdk/agent-runtime";
 //#region extensions/codex/src/app-server/session-binding.ts
 var session_binding_exports = /* @__PURE__ */ __exportAll({
 	clearCodexAppServerBinding: () => clearCodexAppServerBinding,
+	clearCodexAppServerBindingForThread: () => clearCodexAppServerBindingForThread,
 	isCodexAppServerNativeAuthProfile: () => isCodexAppServerNativeAuthProfile,
 	normalizeCodexAppServerBindingModelProvider: () => normalizeCodexAppServerBindingModelProvider,
 	readCodexAppServerBinding: () => readCodexAppServerBinding,
 	resolveCodexAppServerBindingPath: () => resolveCodexAppServerBindingPath,
 	writeCodexAppServerBinding: () => writeCodexAppServerBinding
 });
-const CODEX_APP_SERVER_NATIVE_AUTH_PROVIDER = "openai-codex";
+const CODEX_APP_SERVER_NATIVE_AUTH_PROVIDER = "openai";
 const PUBLIC_OPENAI_MODEL_PROVIDER = "openai";
 function resolveCodexAppServerBindingPath(sessionFile) {
 	return `${sessionFile}.codex-app-server.json`;
@@ -132,7 +133,7 @@ function readPluginAppPolicyContext(value) {
 	for (const [appId, rawEntry] of Object.entries(apps)) {
 		if (!rawEntry || typeof rawEntry !== "object" || Array.isArray(rawEntry)) return;
 		const entry = rawEntry;
-		if ("appId" in entry || typeof entry.configKey !== "string" || entry.marketplaceName !== "openai-curated" || typeof entry.pluginName !== "string" || typeof entry.allowDestructiveActions !== "boolean" || !Array.isArray(entry.mcpServerNames) || entry.mcpServerNames.some((serverName) => typeof serverName !== "string")) return;
+		if ("appId" in entry || typeof entry.configKey !== "string" || typeof entry.marketplaceName !== "string" || !isCodexPluginsMarketplaceName(entry.marketplaceName) || typeof entry.pluginName !== "string" || typeof entry.allowDestructiveActions !== "boolean" || !Array.isArray(entry.mcpServerNames) || entry.mcpServerNames.some((serverName) => typeof serverName !== "string")) return;
 		parsedApps[appId] = {
 			configKey: entry.configKey,
 			marketplaceName: entry.marketplaceName,
@@ -164,6 +165,20 @@ async function clearCodexAppServerBinding(sessionFile, _lookup = {}) {
 		});
 	}
 }
+async function clearCodexAppServerBindingForThread(sessionFile, threadId, lookup = {}) {
+	const binding = await readCodexAppServerBinding(sessionFile, lookup);
+	if (!binding) return false;
+	if (binding.threadId !== threadId) {
+		embeddedAgentLog.debug("codex app-server binding points at a different thread; preserving", {
+			sessionFile,
+			threadId,
+			boundThreadId: binding.threadId
+		});
+		return false;
+	}
+	await clearCodexAppServerBinding(sessionFile);
+	return true;
+}
 function isNotFound(error) {
 	return Boolean(error && typeof error === "object" && "code" in error && error.code === "ENOENT");
 }
@@ -171,11 +186,13 @@ function isCodexAppServerNativeAuthProfile(lookup) {
 	const authProfileId = lookup.authProfileId?.trim();
 	if (!authProfileId) return false;
 	try {
-		return isCodexAppServerNativeAuthProvider({
-			provider: resolveCodexAppServerAuthProfileCredential({
-				...lookup,
-				authProfileId
-			})?.provider,
+		const credential = resolveCodexAppServerAuthProfileCredential({
+			...lookup,
+			authProfileId
+		});
+		if (!credential || credential.type === "api_key") return false;
+		return isOpenAiAuthProvider({
+			provider: credential.provider,
 			config: lookup.config
 		});
 	} catch (error) {
@@ -209,7 +226,7 @@ function loadCodexAppServerAuthProfileStore(params) {
 		externalCliProfileIds: [params.authProfileId]
 	});
 }
-function isCodexAppServerNativeAuthProvider(params) {
+function isOpenAiAuthProvider(params) {
 	const provider = params.provider?.trim();
 	return Boolean(provider && resolveProviderIdForAuth(provider, { config: params.config }) === CODEX_APP_SERVER_NATIVE_AUTH_PROVIDER);
 }
@@ -223,4 +240,4 @@ function readServiceTier(value) {
 	return normalizeCodexServiceTier(value);
 }
 //#endregion
-export { session_binding_exports as a, readCodexAppServerBinding as i, isCodexAppServerNativeAuthProfile as n, writeCodexAppServerBinding as o, normalizeCodexAppServerBindingModelProvider as r, clearCodexAppServerBinding as t };
+export { readCodexAppServerBinding as a, normalizeCodexAppServerBindingModelProvider as i, clearCodexAppServerBindingForThread as n, session_binding_exports as o, isCodexAppServerNativeAuthProfile as r, writeCodexAppServerBinding as s, clearCodexAppServerBinding as t };

package/dist/{shared-client-Duh1bHaP.js → shared-client-DBlR-rV2.js}

@@ -1,6 +1,6 @@
 import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
-import { l as resolveCodexAppServerRuntimeOptions, n as codexAppServerStartOptionsKey } from "./config--tW89bHH.js";
-import { c as resolveCodexAppServerSpawnEnv, o as MANAGED_CODEX_APP_SERVER_PACKAGE, t as CodexAppServerClient } from "./client-DMXvboVu.js";
+import { d as resolveCodexAppServerRuntimeOptions, r as codexAppServerStartOptionsKey } from "./config-AlzuNKCY.js";
+import { c as resolveCodexAppServerSpawnEnv, o as MANAGED_CODEX_APP_SERVER_PACKAGE, t as CodexAppServerClient } from "./client-BnOmn0y-.js";
 import { createRequire } from "node:module";
 import { createHash } from "node:crypto";
 import fsSync, { constants, readFileSync } from "node:fs";
@@ -11,9 +11,9 @@ import { ensureAuthProfileStore, ensureAuthProfileStoreWithoutExternalProfiles,
 import { fileURLToPath } from "node:url";
 import { withTimeout } from "openclaw/plugin-sdk/security-runtime";
 //#region extensions/codex/src/app-server/auth-bridge.ts
-const CODEX_APP_SERVER_AUTH_PROVIDER = "openai-codex";
+const CODEX_APP_SERVER_AUTH_PROVIDER = "openai";
 const OPENAI_PROVIDER = "openai";
-const OPENAI_CODEX_DEFAULT_PROFILE_ID = "openai-codex:default";
+const OPENAI_CODEX_DEFAULT_PROFILE_ID = "openai:default";
 const CODEX_HOME_ENV_VAR = "CODEX_HOME";
 const HOME_ENV_VAR = "HOME";
 const CODEX_APP_SERVER_HOME_DIRNAME = "codex-home";
@@ -546,13 +546,17 @@ async function withTimeout$1(promise, timeoutMs, timeoutMessage) {
 //#endregion
 //#region extensions/codex/src/app-server/shared-client.ts
 var shared_client_exports = /* @__PURE__ */ __exportAll({
+	clearSharedCodexAppServerClient: () => clearSharedCodexAppServerClient,
 	clearSharedCodexAppServerClientAndWait: () => clearSharedCodexAppServerClientAndWait,
 	clearSharedCodexAppServerClientIfCurrent: () => clearSharedCodexAppServerClientIfCurrent,
 	clearSharedCodexAppServerClientIfCurrentAndWait: () => clearSharedCodexAppServerClientIfCurrentAndWait,
 	createIsolatedCodexAppServerClient: () => createIsolatedCodexAppServerClient,
+	detachSharedCodexAppServerClientIfCurrent: () => detachSharedCodexAppServerClientIfCurrent,
 	getLeasedSharedCodexAppServerClient: () => getLeasedSharedCodexAppServerClient,
 	getSharedCodexAppServerClient: () => getSharedCodexAppServerClient,
 	releaseLeasedSharedCodexAppServerClient: () => releaseLeasedSharedCodexAppServerClient,
+	resetSharedCodexAppServerClientForTests: () => resetSharedCodexAppServerClientForTests,
+	retainSharedCodexAppServerClientIfCurrent: () => retainSharedCodexAppServerClientIfCurrent,
 	retireSharedCodexAppServerClientIfCurrent: () => retireSharedCodexAppServerClientIfCurrent
 });
 const SHARED_CODEX_APP_SERVER_CLIENT_STATE = Symbol.for("openclaw.codexAppServerClientState");
@@ -654,6 +658,7 @@ async function acquireSharedCodexAppServerClient(options, leaseOptions) {
 	const sharedPromise = entry.promise ?? (entry.promise = (async () => {
 		const client = CodexAppServerClient.start(startOptions);
 		entry.client = client;
+		client.setActiveSharedLeaseCountProviderForUnscopedNotifications(() => entry.activeLeases);
 		client.addCloseHandler((closedClient) => clearSharedClientEntryIfCurrent(key, closedClient));
 		try {
 			await client.initialize();
@@ -672,6 +677,7 @@ async function acquireSharedCodexAppServerClient(options, leaseOptions) {
 	})());
 	try {
 		const client = await withTimeout$1(sharedPromise, options?.timeoutMs ?? 0, "codex app-server initialize timed out");
+		client.setActiveSharedLeaseCountProviderForUnscopedNotifications(() => entry.activeLeases);
 		const release = leaseOptions?.leased ? retainSharedClientEntry(entry) : void 0;
 		return release ? {
 			client,
@@ -703,6 +709,15 @@ async function createIsolatedCodexAppServerClient(options) {
 		throw error;
 	}
 }
+function resetSharedCodexAppServerClientForTests() {
+	getSharedCodexAppServerClientState().clients.clear();
+}
+function clearSharedCodexAppServerClient() {
+	const state = getSharedCodexAppServerClientState();
+	const clients = collectSharedClients(state);
+	state.clients.clear();
+	for (const client of clients) client.close();
+}
 function clearSharedCodexAppServerClientIfCurrent(client) {
 	if (!client) return false;
 	const state = getSharedCodexAppServerClientState();
@@ -713,6 +728,20 @@ function clearSharedCodexAppServerClientIfCurrent(client) {
 	}
 	return false;
 }
+function detachSharedCodexAppServerClientIfCurrent(client) {
+	if (!client) return false;
+	const state = getSharedCodexAppServerClientState();
+	for (const [key, entry] of state.clients) if (entry.client === client) {
+		state.clients.delete(key);
+		return true;
+	}
+	return false;
+}
+function retainSharedCodexAppServerClientIfCurrent(client) {
+	if (!client) return;
+	const state = getSharedCodexAppServerClientState();
+	for (const entry of state.clients.values()) if (entry.client === client) return retainSharedClientEntry(entry);
+}
 function retireSharedCodexAppServerClientIfCurrent(client) {
 	if (!client) return;
 	const state = getSharedCodexAppServerClientState();

package/dist/{side-question-B-Cjb9wm.js → side-question-SjBLGANT.js}

@@ -1,12 +1,12 @@
-import { c as readCodexPluginConfig, l as resolveCodexAppServerRuntimeOptions, p as shouldAutoApproveCodexAppServerApprovals } from "./config--tW89bHH.js";
-import { a as readCodexDynamicToolCallParams, c as readCodexTurn, i as assertCodexTurnStartResponse, t as assertCodexThreadForkResponse } from "./protocol-validators-DtjYmUw_.js";
-import { i as isCodexAppServerApprovalRequest, l as isJsonObject } from "./client-DMXvboVu.js";
-import { d as resolveReasoningEffort, g as mergeCodexThreadConfigs, r as buildCodexRuntimeThreadConfig, t as CODEX_NATIVE_PERSONALITY_NONE, u as resolveCodexAppServerModelProvider } from "./thread-lifecycle-Dv9Npl7a.js";
-import { i as readCodexAppServerBinding } from "./session-binding-ueMCn4om.js";
-import { h as formatCodexUsageLimitErrorMessage, i as readCodexNotificationTurnId, r as readCodexNotificationThreadId } from "./notification-correlation-BDakP_d3.js";
-import { a as releaseLeasedSharedCodexAppServerClient, i as getLeasedSharedCodexAppServerClient, l as refreshCodexAppServerAuthTokens } from "./shared-client-Duh1bHaP.js";
-import { n as resolveCodexNativeExecutionBlock } from "./sandbox-guard-mXE4_vE_.js";
-import { d as emitDynamicToolErrorDiagnostic, f as emitDynamicToolStartedDiagnostic, h as filterCodexDynamicTools, i as buildCodexNativeHookRelayDisabledConfig, l as handleCodexAppServerElicitationRequest, m as filterToolsForVisionInputs, p as emitDynamicToolTerminalDiagnostic, r as buildCodexNativeHookRelayConfig, t as CODEX_NATIVE_HOOK_RELAY_EVENTS, u as createCodexDynamicToolBridge, v as resolveCodexDynamicToolsLoading, y as handleCodexAppServerApprovalRequest } from "./native-hook-relay-B8qM8ZwR.js";
+import { d as resolveCodexAppServerRuntimeOptions, h as shouldAutoApproveCodexAppServerApprovals, u as readCodexPluginConfig } from "./config-AlzuNKCY.js";
+import { a as readCodexDynamicToolCallParams, c as readCodexTurn, i as assertCodexTurnStartResponse, t as assertCodexThreadForkResponse } from "./protocol-validators-DIt7cXIp.js";
+import { i as isCodexAppServerApprovalRequest, l as isJsonObject } from "./client-BnOmn0y-.js";
+import { d as resolveReasoningEffort, g as mergeCodexThreadConfigs, r as buildCodexRuntimeThreadConfig, t as CODEX_NATIVE_PERSONALITY_NONE, u as resolveCodexAppServerModelProvider } from "./thread-lifecycle-Bnlv_Q8u.js";
+import { a as readCodexAppServerBinding } from "./session-binding-BXJAV_xy.js";
+import { h as formatCodexUsageLimitErrorMessage, i as readCodexNotificationTurnId, r as readCodexNotificationThreadId } from "./notification-correlation-BykOI_jh.js";
+import { a as releaseLeasedSharedCodexAppServerClient, i as getLeasedSharedCodexAppServerClient, l as refreshCodexAppServerAuthTokens } from "./shared-client-DBlR-rV2.js";
+import { n as resolveCodexNativeExecutionBlock } from "./sandbox-guard-DMCJlzmz.js";
+import { d as emitDynamicToolErrorDiagnostic, f as emitDynamicToolStartedDiagnostic, h as filterCodexDynamicTools, i as buildCodexNativeHookRelayDisabledConfig, l as handleCodexAppServerElicitationRequest, m as filterToolsForVisionInputs, p as emitDynamicToolTerminalDiagnostic, r as buildCodexNativeHookRelayConfig, t as CODEX_NATIVE_HOOK_RELAY_EVENTS, u as createCodexDynamicToolBridge, v as resolveCodexDynamicToolsLoading, y as handleCodexAppServerApprovalRequest } from "./native-hook-relay-DCxPRaBN.js";
 import { n as rememberCodexRateLimits, t as readRecentCodexRateLimits } from "./rate-limit-cache-N66I-Rd7.js";
 import { buildAgentHookContextChannelFields, embeddedAgentLog, formatErrorMessage, registerNativeHookRelay, resolveAgentDir, resolveAttemptSpawnWorkspaceDir, resolveModelAuthMode, resolveSandboxContext, resolveSessionAgentIds, supportsModelTools } from "openclaw/plugin-sdk/agent-harness-runtime";
 //#region extensions/codex/src/app-server/side-question.ts
@@ -418,7 +418,7 @@ async function handleSideDynamicToolCallWithTimeout(params) {
 	let resolveAbort;
 	const abortFromRun = () => {
 		const message = "OpenClaw dynamic tool call aborted.";
-		controller.abort(params.signal.reason ?? new Error(message));
+		controller.abort(params.signal.reason ?? /* @__PURE__ */ new Error(message));
 		resolveAbort?.(failedSideDynamicToolResponse(message));
 	};
 	const abortPromise = new Promise((resolve) => {

package/dist/{thread-lifecycle-Dv9Npl7a.js → thread-lifecycle-Bnlv_Q8u.js}

@@ -1,15 +1,17 @@
-import { d as resolveCodexPluginsPolicy, r as codexSandboxPolicyForTurn, t as CODEX_PLUGINS_MARKETPLACE_NAME } from "./config--tW89bHH.js";
-import { n as assertCodexThreadResumeResponse, r as assertCodexThreadStartResponse } from "./protocol-validators-DtjYmUw_.js";
-import { a as isCodexAppServerConnectionClosedError, l as isJsonObject, n as CodexAppServerRpcError } from "./client-DMXvboVu.js";
+import { i as codexSandboxPolicyForTurn, n as CODEX_PLUGINS_MARKETPLACE_NAMES, p as resolveCodexPluginsPolicy, s as isCodexPluginsMarketplaceName, t as CODEX_PLUGINS_MARKETPLACE_NAME } from "./config-AlzuNKCY.js";
+import { n as assertCodexThreadResumeResponse, r as assertCodexThreadStartResponse } from "./protocol-validators-DIt7cXIp.js";
+import { a as isCodexAppServerConnectionClosedError, l as isJsonObject, n as CodexAppServerRpcError } from "./client-BnOmn0y-.js";
 import { CODEX_GPT5_HEARTBEAT_PROMPT_OVERLAY } from "./prompt-overlay.js";
 import { isModernCodexModel } from "./provider.js";
-import { i as readCodexAppServerBinding, n as isCodexAppServerNativeAuthProfile, o as writeCodexAppServerBinding, t as clearCodexAppServerBinding } from "./session-binding-ueMCn4om.js";
+import { a as readCodexAppServerBinding, r as isCodexAppServerNativeAuthProfile, s as writeCodexAppServerBinding, t as clearCodexAppServerBinding } from "./session-binding-BXJAV_xy.js";
+import { isFutureDateTimestampMs, resolveDateTimestampMs, resolveExpiresAtMsFromDurationMs } from "openclaw/plugin-sdk/number-runtime";
 import crypto from "node:crypto";
 import { isRecord } from "openclaw/plugin-sdk/string-coerce-runtime";
-import { embeddedAgentLog, formatErrorMessage, isActiveHarnessContextEngine } from "openclaw/plugin-sdk/agent-harness-runtime";
+import { SKILL_WORKSHOP_TOOL_NAME, buildSkillWorkshopPromptSection, embeddedAgentLog, formatErrorMessage, isActiveHarnessContextEngine } from "openclaw/plugin-sdk/agent-harness-runtime";
 import { buildCodexUserMcpServersThreadConfigPatch } from "openclaw/plugin-sdk/codex-mcp-projection";
 import { listRegisteredPluginAgentPromptGuidance } from "openclaw/plugin-sdk/plugin-runtime";
 import { redactSensitiveFieldValue, redactToolPayloadText } from "openclaw/plugin-sdk/logging-core";
+import { INLINE_IMAGE_DATA_URL_PREFIX, sanitizeInlineImageDataUrl } from "openclaw/plugin-sdk/inline-image-data-url-runtime";
 import "node:fs/promises";
 import "node:path";
 import { isDiagnosticFlagEnabled } from "openclaw/plugin-sdk/diagnostic-runtime";
@@ -226,78 +228,9 @@ function truncateOlderContext(text, maxChars) {
 }
 //#endregion
 //#region extensions/codex/src/app-server/image-payload-sanitizer.ts
-const DATA_URL_PREFIX = "data:";
 const IMAGE_OMITTED_TEXT = "omitted image payload: invalid inline image data";
-const IMAGE_SIGNATURES = [
-	{
-		mime: "image/png",
-		matches: (buffer) => buffer.length >= 8 && buffer[0] === 137 && buffer[1] === 80 && buffer[2] === 78 && buffer[3] === 71 && buffer[4] === 13 && buffer[5] === 10 && buffer[6] === 26 && buffer[7] === 10
-	},
-	{
-		mime: "image/jpeg",
-		matches: (buffer) => buffer.length >= 3 && buffer[0] === 255 && buffer[1] === 216 && buffer[2] === 255
-	},
-	{
-		mime: "image/webp",
-		matches: (buffer) => buffer.length >= 12 && buffer.subarray(0, 4).toString("ascii") === "RIFF" && buffer.subarray(8, 12).toString("ascii") === "WEBP"
-	},
-	{
-		mime: "image/gif",
-		matches: (buffer) => buffer.length >= 6 && (buffer.subarray(0, 6).toString("ascii") === "GIF87a" || buffer.subarray(0, 6).toString("ascii") === "GIF89a")
-	}
-];
-function startsWithDataUrl(value) {
-	return value.slice(0, 5).toLowerCase() === DATA_URL_PREFIX;
-}
-function canonicalizeBase64(base64) {
-	let cleaned = "";
-	let padding = 0;
-	let sawPadding = false;
-	for (let i = 0; i < base64.length; i += 1) {
-		const code = base64.charCodeAt(i);
-		if (code <= 32) continue;
-		if (code === 61) {
-			padding += 1;
-			if (padding > 2) return;
-			sawPadding = true;
-			cleaned += "=";
-			continue;
-		}
-		if (sawPadding || !(code >= 65 && code <= 90 || code >= 97 && code <= 122 || code >= 48 && code <= 57 || code === 43 || code === 47)) return;
-		cleaned += base64[i];
-	}
-	if (!cleaned || cleaned.length % 4 !== 0) return;
-	return cleaned;
-}
-function sniffImageMime(buffer) {
-	return IMAGE_SIGNATURES.find((signature) => signature.matches(buffer))?.mime;
-}
-function parseImageDataUrl(value) {
-	if (!startsWithDataUrl(value)) return {
-		metadata: [],
-		payload: value
-	};
-	const commaIndex = value.indexOf(",");
-	if (commaIndex < 0) return;
-	return {
-		metadata: value.slice(5, commaIndex).split(";").map((part) => part.trim()),
-		payload: value.slice(commaIndex + 1)
-	};
-}
-function metadataAllowsImageBase64(metadata) {
-	const [mimeType, ...options] = metadata;
-	return mimeType !== void 0 && mimeType.toLowerCase().startsWith("image/") && options.some((part) => part.toLowerCase() === "base64");
-}
-function sanitizeInlineImageDataUrl(imageUrl) {
-	const parsed = parseImageDataUrl(imageUrl);
-	if (!parsed) return;
-	if (parsed.metadata.length === 0) return imageUrl;
-	if (!metadataAllowsImageBase64(parsed.metadata)) return;
-	const canonicalPayload = canonicalizeBase64(parsed.payload);
-	if (!canonicalPayload) return;
-	const sniffedMimeType = sniffImageMime(Buffer.from(canonicalPayload, "base64"));
-	if (!sniffedMimeType) return;
-	return `data:${sniffedMimeType};base64,${canonicalPayload}`;
+function sanitizeInlineImageDataUrl$1(imageUrl) {
+	return sanitizeInlineImageDataUrl(imageUrl);
 }
 function invalidInlineImageText(label) {
 	return `[${label}] ${IMAGE_OMITTED_TEXT}`;
@@ -305,13 +238,13 @@ function invalidInlineImageText(label) {
 function sanitizeImageContentRecord(record, label) {
 	if (record.type === "image" && typeof record.data === "string") {
 		const mimeType = typeof record.mimeType === "string" ? record.mimeType : "image/png";
-		const imageUrl = sanitizeInlineImageDataUrl(`data:${mimeType};base64,${record.data}`);
+		const imageUrl = sanitizeInlineImageDataUrl$1(`data:${mimeType};base64,${record.data}`);
 		if (!imageUrl) return {
 			type: "text",
 			text: invalidInlineImageText(label)
 		};
 		const commaIndex = imageUrl.indexOf(",");
-		const mime = imageUrl.slice(5, commaIndex).split(";")[0] ?? mimeType;
+		const mime = imageUrl.slice(INLINE_IMAGE_DATA_URL_PREFIX.length, commaIndex).split(";")[0] ?? mimeType;
 		return {
 			...record,
 			mimeType: mime,
@@ -319,7 +252,7 @@ function sanitizeImageContentRecord(record, label) {
 		};
 	}
 	if (record.type === "inputImage" && typeof record.imageUrl === "string") {
-		const imageUrl = sanitizeInlineImageDataUrl(record.imageUrl);
+		const imageUrl = sanitizeInlineImageDataUrl$1(record.imageUrl);
 		return imageUrl ? {
 			...record,
 			imageUrl
@@ -329,7 +262,7 @@ function sanitizeImageContentRecord(record, label) {
 		};
 	}
 	if (record.type === "input_image" && typeof record.image_url === "string") {
-		const imageUrl = sanitizeInlineImageDataUrl(record.image_url);
+		const imageUrl = sanitizeInlineImageDataUrl$1(record.image_url);
 		return imageUrl ? {
 			...record,
 			image_url: imageUrl
@@ -359,7 +292,7 @@ var CodexAppInventoryCache = class {
 		this.ttlMs = options.ttlMs ?? 36e5;
 	}
 	read(params) {
-		const nowMs = params.nowMs ?? Date.now();
+		const nowMs = resolveDateTimestampMs(params.nowMs);
 		const entry = this.entries.get(params.key);
 		if (!entry) {
 			const refreshScheduled = params.suppressRefresh ? false : this.scheduleRefresh(params);
@@ -371,7 +304,7 @@ var CodexAppInventoryCache = class {
 				...this.diagnostics.get(params.key) ? { diagnostic: this.diagnostics.get(params.key) } : {}
 			};
 		}
-		const state = entry.invalidated || entry.expiresAtMs <= nowMs ? "stale" : "fresh";
+		const state = entry.invalidated || !isFutureDateTimestampMs(entry.expiresAtMs, { nowMs }) ? "stale" : "fresh";
 		const refreshScheduled = state === "fresh" && !params.forceRefetch ? false : this.scheduleRefresh(params);
 		return {
 			state,
@@ -430,15 +363,16 @@ var CodexAppInventoryCache = class {
 		}
 	}
 	async refreshUncoalesced(params, refreshToken) {
-		const nowMs = params.nowMs ?? Date.now();
+		const nowMs = resolveDateTimestampMs(params.nowMs);
 		try {
 			const apps = await listAllApps(params.request, params.forceRefetch ?? false);
 			this.revision += 1;
+			const expiresAtMs = resolveExpiresAtMsFromDurationMs(this.ttlMs, { nowMs }) ?? 0;
 			const snapshot = {
 				key: params.key,
 				apps,
 				fetchedAtMs: nowMs,
-				expiresAtMs: nowMs + this.ttlMs,
+				expiresAtMs,
 				revision: this.revision
 			};
 			if (this.refreshTokens.get(params.key) === refreshToken) {
@@ -548,18 +482,9 @@ async function readCodexPluginInventory(params) {
 		}]
 	};
 	const appInventory = readCachedAppInventory(params);
-	const marketplaceEntry = (await params.request("plugin/list", { cwds: [] })).marketplaces.find((marketplace) => marketplace.name === CODEX_PLUGINS_MARKETPLACE_NAME);
-	if (!marketplaceEntry) return {
-		policy,
-		records: [],
-		diagnostics: policy.pluginPolicies.filter((pluginPolicy) => pluginPolicy.enabled).map((pluginPolicy) => ({
-			code: "marketplace_missing",
-			plugin: pluginPolicy,
-			message: `Codex marketplace ${CODEX_PLUGINS_MARKETPLACE_NAME} was not found.`
-		})),
-		...appInventory ? { appInventory } : {}
-	};
-	const marketplace = marketplaceRef(marketplaceEntry);
+	const listed = await params.request("plugin/list", { cwds: [] });
+	const marketplaceByName = /* @__PURE__ */ new Map();
+	for (const marketplace of listed.marketplaces) if (isCodexPluginsMarketplaceName(marketplace.name)) marketplaceByName.set(marketplace.name, marketplace);
 	const diagnostics = [];
 	const records = [];
 	if (appInventory?.state === "missing") diagnostics.push({
@@ -572,12 +497,22 @@ async function readCodexPluginInventory(params) {
 	});
 	for (const pluginPolicy of policy.pluginPolicies) {
 		if (!pluginPolicy.enabled) continue;
+		const marketplaceEntry = marketplaceByName.get(pluginPolicy.marketplaceName);
+		if (!marketplaceEntry) {
+			diagnostics.push({
+				code: "marketplace_missing",
+				plugin: pluginPolicy,
+				message: `Codex marketplace ${pluginPolicy.marketplaceName} was not found.`
+			});
+			continue;
+		}
+		const marketplace = marketplaceRef(marketplaceEntry);
 		const summary = findPluginSummary(marketplaceEntry, pluginPolicy.pluginName);
 		if (!summary) {
 			diagnostics.push({
 				code: "plugin_missing",
 				plugin: pluginPolicy,
-				message: `${pluginPolicy.pluginName} was not found in ${CODEX_PLUGINS_MARKETPLACE_NAME}.`
+				message: `${pluginPolicy.pluginName} was not found in ${pluginPolicy.marketplaceName}.`
 			});
 			continue;
 		}
@@ -616,20 +551,30 @@ async function readCodexPluginInventory(params) {
 	}
 	return {
 		policy,
-		marketplace,
 		records,
 		diagnostics,
 		...appInventory ? { appInventory } : {}
 	};
 }
-function findOpenAiCuratedPluginSummary(listed, pluginName) {
-	const marketplaceEntry = listed.marketplaces.find((marketplace) => marketplace.name === CODEX_PLUGINS_MARKETPLACE_NAME);
-	if (!marketplaceEntry) return;
-	const summary = findPluginSummary(marketplaceEntry, pluginName);
-	return summary ? {
-		marketplace: marketplaceRef(marketplaceEntry),
-		summary
-	} : void 0;
+function findOpenAiCuratedPluginSummary(listed, pluginName, marketplaceName) {
+	if (marketplaceName) {
+		const marketplaceEntry = listed.marketplaces.find((marketplace) => marketplace.name === marketplaceName);
+		if (!marketplaceEntry) return;
+		const summary = findPluginSummary(marketplaceEntry, pluginName);
+		return summary ? {
+			marketplace: marketplaceRef(marketplaceEntry),
+			summary
+		} : void 0;
+	}
+	for (const allowedName of CODEX_PLUGINS_MARKETPLACE_NAMES) {
+		const marketplaceEntry = listed.marketplaces.find((marketplace) => marketplace.name === allowedName);
+		if (!marketplaceEntry) continue;
+		const summary = findPluginSummary(marketplaceEntry, pluginName);
+		if (summary) return {
+			marketplace: marketplaceRef(marketplaceEntry),
+			summary
+		};
+	}
 }
 function pluginReadParams(marketplace, pluginName) {
 	return {
@@ -706,7 +651,7 @@ function pluginNameFromPluginId(pluginId, marketplaceName) {
 }
 function marketplaceRef(marketplace) {
 	return {
-		name: CODEX_PLUGINS_MARKETPLACE_NAME,
+		name: isCodexPluginsMarketplaceName(marketplace.name) ? marketplace.name : CODEX_PLUGINS_MARKETPLACE_NAME,
 		...marketplace.path ? { path: marketplace.path } : {},
 		...!marketplace.path ? { remoteMarketplaceName: marketplace.name } : {}
 	};
@@ -714,12 +659,12 @@ function marketplaceRef(marketplace) {
 //#endregion
 //#region extensions/codex/src/app-server/plugin-activation.ts
 async function ensureCodexPluginActivation(params) {
-	if (params.identity.marketplaceName !== "openai-curated") return activationFailure(params.identity, "marketplace_missing", { message: "Only " + CODEX_PLUGINS_MARKETPLACE_NAME + " plugins can be activated." });
+	if (!isCodexPluginsMarketplaceName(params.identity.marketplaceName)) return activationFailure(params.identity, "marketplace_missing", { message: "Only " + CODEX_PLUGINS_MARKETPLACE_NAMES.join(" or ") + " plugins can be activated." });
 	const listed = await params.request("plugin/list", { cwds: [] });
-	const resolved = findOpenAiCuratedPluginSummary(listed, params.identity.pluginName);
+	const resolved = findOpenAiCuratedPluginSummary(listed, params.identity.pluginName, params.identity.marketplaceName);
 	if (!resolved) {
-		if (!listed.marketplaces.some((marketplace) => marketplace.name === "openai-curated")) return activationFailure(params.identity, "marketplace_missing", { message: `Codex marketplace ${CODEX_PLUGINS_MARKETPLACE_NAME} was not found.` });
-		return activationFailure(params.identity, "plugin_missing", { message: `${params.identity.pluginName} was not found in ${CODEX_PLUGINS_MARKETPLACE_NAME}.` });
+		if (!listed.marketplaces.some((marketplace) => marketplace.name === params.identity.marketplaceName)) return activationFailure(params.identity, "marketplace_missing", { message: `Codex marketplace ${params.identity.marketplaceName} was not found.` });
+		return activationFailure(params.identity, "plugin_missing", { message: `${params.identity.pluginName} was not found in ${params.identity.marketplaceName}.` });
 	}
 	if (resolved.summary.installed && resolved.summary.enabled && !params.installEvenIfActive) return {
 		identity: params.identity,
@@ -1084,7 +1029,8 @@ var CodexThreadStartRequestError = class extends Error {
 const CODEX_NATIVE_PERSONALITY_NONE = "none";
 const CODEX_CODE_MODE_THREAD_CONFIG = {
 	"features.code_mode": true,
-	"features.code_mode_only": false
+	"features.code_mode_only": false,
+	"features.apply_patch_streaming_events": true
 };
 const CODEX_CODE_MODE_DISABLED_THREAD_CONFIG = {
 	"features.code_mode": false,
@@ -1554,7 +1500,11 @@ function buildCodexRuntimeThreadConfig(config, options = {}) {
 		...CODEX_CODE_MODE_THREAD_CONFIG,
 		"features.code_mode_only": options.nativeCodeModeOnlyEnabled === true
 	};
-	if (options.nativeCodeModeEnabled === false) return mergeCodexThreadConfigs(codeModeConfig, config, CODEX_CODE_MODE_DISABLED_THREAD_CONFIG) ?? { ...CODEX_CODE_MODE_DISABLED_THREAD_CONFIG };
+	if (options.nativeCodeModeEnabled === false) {
+		const disabledConfig = mergeCodexThreadConfigs(config, CODEX_CODE_MODE_DISABLED_THREAD_CONFIG) ?? { ...CODEX_CODE_MODE_DISABLED_THREAD_CONFIG };
+		delete disabledConfig["features.apply_patch_streaming_events"];
+		return disabledConfig;
+	}
 	if (options.nativeCodeModeOnlyEnabled === true) return mergeCodexThreadConfigs(codeModeConfig, config, { "features.code_mode_only": true }) ?? {
 		...codeModeConfig,
 		"features.code_mode_only": true
@@ -1584,6 +1534,8 @@ function buildTurnStartParams(params, options) {
 		...options.environmentSelection ? { environments: options.environmentSelection } : {},
 		collaborationMode: buildTurnCollaborationMode(params, {
 			turnScopedDeveloperInstructions: options.turnScopedDeveloperInstructions,
+			skillsCollaborationInstructions: options.skillsCollaborationInstructions,
+			memoryCollaborationInstructions: options.memoryCollaborationInstructions,
 			heartbeatCollaborationInstructions: options.heartbeatCollaborationInstructions
 		})
 	};
@@ -1604,9 +1556,10 @@ function buildTurnCollaborationMode(params, options = {}) {
 	};
 }
 function buildTurnScopedCollaborationInstructions(params, options = {}) {
-	if (params.trigger === "cron") return joinPresentSections(buildCronCollaborationInstructions(), options.turnScopedDeveloperInstructions);
-	if (params.trigger === "heartbeat") return joinPresentSections(buildHeartbeatCollaborationInstructions(), options.turnScopedDeveloperInstructions, options.heartbeatCollaborationInstructions);
-	if (options.turnScopedDeveloperInstructions?.trim()) return joinPresentSections(buildDefaultCollaborationInstructions(), options.turnScopedDeveloperInstructions);
+	const contextInstructions = joinPresentSections(options.turnScopedDeveloperInstructions, options.memoryCollaborationInstructions, options.skillsCollaborationInstructions);
+	if (params.trigger === "cron") return joinPresentSections(buildCronCollaborationInstructions(), contextInstructions);
+	if (params.trigger === "heartbeat") return joinPresentSections(buildHeartbeatCollaborationInstructions(), contextInstructions, options.heartbeatCollaborationInstructions);
+	if (contextInstructions?.trim()) return joinPresentSections(buildDefaultCollaborationInstructions(), contextInstructions);
 	return null;
 }
 function buildDefaultCollaborationInstructions() {
@@ -1691,6 +1644,7 @@ function buildDeveloperInstructions(params, options = {}) {
 	return [
 		"You are a personal agent running inside OpenClaw. OpenClaw has dynamic tools for OpenClaw-owned messaging, cron, sessions, media, gateway, and nodes.",
 		buildDeferredDynamicToolManifest(options.dynamicTools),
+		buildSkillWorkshopInstruction(options.dynamicTools),
 		"Use Codex native `spawn_agent` for Codex subagents. Use OpenClaw `sessions_spawn` only for OpenClaw or ACP delegation.",
 		buildVisibleReplyInstruction(params, options.dynamicTools),
 		nativeCommandGuidance,
@@ -1702,6 +1656,10 @@ function buildDeferredDynamicToolManifest(dynamicTools) {
 	if (deferredToolNames.length === 0) return;
 	return `Deferred searchable OpenClaw dynamic tools available: ${deferredToolNames.join(", ")}. Use \`tool_search\` to load exact callable specs before use.`;
 }
+function buildSkillWorkshopInstruction(dynamicTools) {
+	if (!(dynamicTools ?? []).some((tool) => tool.name.trim() === SKILL_WORKSHOP_TOOL_NAME)) return;
+	return buildSkillWorkshopPromptSection().join("\n");
+}
 function buildVisibleReplyInstruction(params, dynamicTools) {
 	const messageToolAvailable = dynamicTools ? dynamicTools.some((tool) => tool.name.trim() === "message") : params.disableMessageTool !== true;
 	if (params.sourceReplyDeliveryMode === "message_tool_only" && messageToolAvailable) return "Visible source replies are not automatically delivered for this run. Use `message(action=send)` for user-visible source-channel output. Do not repeat that visible content in your final answer.";
@@ -1710,7 +1668,7 @@ function buildVisibleReplyInstruction(params, dynamicTools) {
 }
 function buildUserInput(params, promptText = params.prompt) {
 	const imageInputs = (params.images ?? []).map((image) => {
-		const imageUrl = sanitizeInlineImageDataUrl(`data:${image.mimeType};base64,${image.data}`);
+		const imageUrl = sanitizeInlineImageDataUrl$1(`data:${image.mimeType};base64,${image.data}`);
 		return imageUrl ? {
 			type: "image",
 			url: imageUrl
@@ -1730,8 +1688,8 @@ function resolveCodexAppServerModelProvider(params) {
 	const normalized = params.provider.trim();
 	const normalizedLower = normalized.toLowerCase();
 	if (!normalized || normalizedLower === "codex") return;
-	if (isCodexAppServerNativeAuthProfile(params) && (normalizedLower === "openai" || normalizedLower === "openai-codex")) return;
-	return normalizedLower === "openai-codex" ? "openai" : normalized;
+	if (isCodexAppServerNativeAuthProfile(params) && normalizedLower === "openai") return;
+	return normalizedLower === "openai" ? "openai" : normalized;
 }
 function resolveReasoningEffort(thinkLevel, modelId) {
 	if (thinkLevel === "minimal") return isModernCodexModel(modelId) ? "low" : "minimal";
@@ -1739,4 +1697,4 @@ function resolveReasoningEffort(thinkLevel, modelId) {
 	return null;
 }
 //#endregion
-export { sanitizeCodexHistoryImagePayloads as C, resolveCodexContextEngineProjectionReserveTokens as D, resolveCodexContextEngineProjectionMaxChars as E, invalidInlineImageText as S, projectContextEngineAssemblyForCodex as T, shouldBuildCodexPluginThreadConfig as _, buildDeveloperInstructions as a, buildCodexAppInventoryCacheKey as b, codexDynamicToolsFingerprint as c, resolveReasoningEffort as d, startOrResumeThread as f, mergeCodexThreadConfigs as g, buildCodexPluginThreadConfigInputFingerprint as h, buildContextEngineBinding as i, isContextEngineBindingCompatible as l, buildCodexPluginThreadConfig as m, areCodexDynamicToolFingerprintsCompatible as n, buildTurnCollaborationMode as o, isCodexAppServerProfilerEnabled as p, buildCodexRuntimeThreadConfig as r, buildTurnStartParams as s, CODEX_NATIVE_PERSONALITY_NONE as t, resolveCodexAppServerModelProvider as u, ensureCodexPluginActivation as v, sanitizeInlineImageDataUrl as w, defaultCodexAppInventoryCache as x, pluginReadParams as y };
+export { sanitizeCodexHistoryImagePayloads as C, resolveCodexContextEngineProjectionReserveTokens as D, resolveCodexContextEngineProjectionMaxChars as E, invalidInlineImageText as S, projectContextEngineAssemblyForCodex as T, shouldBuildCodexPluginThreadConfig as _, buildDeveloperInstructions as a, buildCodexAppInventoryCacheKey as b, codexDynamicToolsFingerprint as c, resolveReasoningEffort as d, startOrResumeThread as f, mergeCodexThreadConfigs as g, buildCodexPluginThreadConfigInputFingerprint as h, buildContextEngineBinding as i, isContextEngineBindingCompatible as l, buildCodexPluginThreadConfig as m, areCodexDynamicToolFingerprintsCompatible as n, buildTurnCollaborationMode as o, isCodexAppServerProfilerEnabled as p, buildCodexRuntimeThreadConfig as r, buildTurnStartParams as s, CODEX_NATIVE_PERSONALITY_NONE as t, resolveCodexAppServerModelProvider as u, ensureCodexPluginActivation as v, sanitizeInlineImageDataUrl$1 as w, defaultCodexAppInventoryCache as x, pluginReadParams as y };