@openclaw/codex 2026.5.3-beta.2 → 2026.5.3-beta.4

package/dist/{capabilities-CYg1OFaL.js → capabilities-BmhO5h8O.js}

@@ -1,4 +1,4 @@
-import { n as CodexAppServerRpcError } from "./client-Bm5-MMSf.js";
+import { n as CodexAppServerRpcError } from "./client-chGfNrq5.js";
 //#region extensions/codex/src/app-server/capabilities.ts
 const CODEX_CONTROL_METHODS = {
 	account: "account/read",

package/dist/{client-factory-Bh5chnqU.js → client-factory-MaOMEltT.js}

@@ -1,5 +1,5 @@
 //#region extensions/codex/src/app-server/client-factory.ts
-const defaultCodexAppServerClientFactory = (startOptions, authProfileId, agentDir) => import("./shared-client-DEzBJ9G1.js").then((n) => n.r).then(({ getSharedCodexAppServerClient }) => getSharedCodexAppServerClient({
+const defaultCodexAppServerClientFactory = (startOptions, authProfileId, agentDir) => import("./shared-client-0El8eRIE.js").then((n) => n.r).then(({ getSharedCodexAppServerClient }) => getSharedCodexAppServerClient({
 	startOptions,
 	authProfileId,
 	agentDir

package/dist/{command-handlers-Dxx2slu2.js → command-handlers-CeaXhO5y.js}

@@ -1,10 +1,10 @@
 import { i as resolveCodexAppServerRuntimeOptions } from "./config-CkkoMeqF.js";
-import { n as listCodexAppServerModels, t as listAllCodexAppServerModels } from "./models-Ddmxtdog.js";
+import { n as listCodexAppServerModels, t as listAllCodexAppServerModels } from "./models-Ds7g6191.js";
 import { t as isJsonObject } from "./protocol-C9UWI98H.js";
-import { n as describeControlFailure, t as CODEX_CONTROL_METHODS } from "./capabilities-CYg1OFaL.js";
-import { i as writeCodexAppServerBinding, n as readCodexAppServerBinding, t as clearCodexAppServerBinding } from "./session-binding-C7Y7rY0i.js";
-import { a as parseCodexFastModeArg, c as setCodexConversationFastMode, d as steerCodexConversationTurn, f as stopCodexConversationTurn, i as formatPermissionsMode, l as setCodexConversationModel, m as resolveCodexDefaultWorkspaceDir, o as parseCodexPermissionsModeArg, p as readCodexConversationBindingData, r as startCodexConversationThread, s as readCodexConversationActiveTurn, u as setCodexConversationPermissions } from "./conversation-binding-D12ISGdf.js";
-import { i as requestCodexAppServerJson, n as installCodexComputerUse, r as readCodexComputerUseStatus } from "./computer-use-BblypQuj.js";
+import { n as describeControlFailure, t as CODEX_CONTROL_METHODS } from "./capabilities-BmhO5h8O.js";
+import { i as readCodexAppServerBinding, o as writeCodexAppServerBinding, t as clearCodexAppServerBinding } from "./session-binding-DuJYTJQy.js";
+import { a as parseCodexFastModeArg, c as setCodexConversationFastMode, d as steerCodexConversationTurn, f as stopCodexConversationTurn, i as formatPermissionsMode, l as setCodexConversationModel, m as resolveCodexDefaultWorkspaceDir, o as parseCodexPermissionsModeArg, p as readCodexConversationBindingData, r as startCodexConversationThread, s as readCodexConversationActiveTurn, u as setCodexConversationPermissions } from "./conversation-binding-DjptpT9W.js";
+import { i as requestCodexAppServerJson, n as installCodexComputerUse, r as readCodexComputerUseStatus } from "./computer-use-amNk2zrB.js";
 import crypto from "node:crypto";
 //#region extensions/codex/src/command-formatters.ts
 function formatCodexStatus(probes) {
@@ -257,14 +257,18 @@ async function bindConversation(deps, ctx, pluginConfig, args) {
 	const parsed = parseBindArgs(args);
 	if (parsed.help) return { text: "Usage: /codex bind [thread-id] [--cwd <path>] [--model <model>] [--provider <provider>]" };
 	const workspaceDir = parsed.cwd ?? deps.resolveCodexDefaultWorkspaceDir(pluginConfig);
-	const data = await deps.startCodexConversationThread({
+	const authProfileId = (await deps.readCodexAppServerBinding(ctx.sessionFile))?.authProfileId;
+	const startParams = {
 		pluginConfig,
+		config: ctx.config,
 		sessionFile: ctx.sessionFile,
 		workspaceDir,
 		threadId: parsed.threadId,
 		model: parsed.model,
 		modelProvider: parsed.provider
-	});
+	};
+	if (authProfileId) startParams.authProfileId = authProfileId;
+	const data = await deps.startCodexConversationThread(startParams);
 	const threadId = (await deps.readCodexAppServerBinding(ctx.sessionFile))?.threadId ?? parsed.threadId ?? "new thread";
 	const summary = `Codex app-server thread ${threadId} in ${workspaceDir}`;
 	let request;

package/dist/{compact-CpZ5DNlM.js → compact-C0_rGlHZ.js}

@@ -1,7 +1,7 @@
 import { i as resolveCodexAppServerRuntimeOptions } from "./config-CkkoMeqF.js";
 import { t as isJsonObject } from "./protocol-C9UWI98H.js";
-import { n as readCodexAppServerBinding } from "./session-binding-C7Y7rY0i.js";
-import { n as defaultCodexAppServerClientFactory, t as createCodexAppServerClientFactoryTestHooks } from "./client-factory-Bh5chnqU.js";
+import { i as readCodexAppServerBinding } from "./session-binding-DuJYTJQy.js";
+import { n as defaultCodexAppServerClientFactory, t as createCodexAppServerClientFactoryTestHooks } from "./client-factory-MaOMEltT.js";
 import { embeddedAgentLog, formatErrorMessage, isActiveHarnessContextEngine, runHarnessContextEngineMaintenance } from "openclaw/plugin-sdk/agent-harness-runtime";
 //#region extensions/codex/src/app-server/compact.ts
 const DEFAULT_CODEX_COMPACTION_WAIT_TIMEOUT_MS = 300 * 1e3;

package/dist/{computer-use-BblypQuj.js → computer-use-amNk2zrB.js}

@@ -1,6 +1,6 @@
 import { a as resolveCodexComputerUseConfig, i as resolveCodexAppServerRuntimeOptions } from "./config-CkkoMeqF.js";
-import { n as describeControlFailure } from "./capabilities-CYg1OFaL.js";
-import { i as withTimeout, n as getSharedCodexAppServerClient } from "./shared-client-DEzBJ9G1.js";
+import { i as withTimeout, n as getSharedCodexAppServerClient } from "./shared-client-0El8eRIE.js";
+import { n as describeControlFailure } from "./capabilities-BmhO5h8O.js";
 import { existsSync } from "node:fs";
 //#region extensions/codex/src/app-server/request.ts
 async function requestCodexAppServerJson(params) {

package/dist/{conversation-binding-D12ISGdf.js → conversation-binding-DjptpT9W.js}

@@ -1,8 +1,8 @@
 import { i as resolveCodexAppServerRuntimeOptions, n as codexSandboxPolicyForTurn } from "./config-CkkoMeqF.js";
 import { t as isJsonObject } from "./protocol-C9UWI98H.js";
-import { t as CODEX_CONTROL_METHODS } from "./capabilities-CYg1OFaL.js";
-import { i as writeCodexAppServerBinding, n as readCodexAppServerBinding, t as clearCodexAppServerBinding } from "./session-binding-C7Y7rY0i.js";
-import { n as getSharedCodexAppServerClient } from "./shared-client-DEzBJ9G1.js";
+import { n as getSharedCodexAppServerClient, s as resolveCodexAppServerAuthProfileIdForAgent } from "./shared-client-0El8eRIE.js";
+import { t as CODEX_CONTROL_METHODS } from "./capabilities-BmhO5h8O.js";
+import { i as readCodexAppServerBinding, n as isCodexAppServerNativeAuthProfile, o as writeCodexAppServerBinding, r as normalizeCodexAppServerBindingModelProvider, t as clearCodexAppServerBinding } from "./session-binding-DuJYTJQy.js";
 import { formatErrorMessage } from "openclaw/plugin-sdk/agent-harness-runtime";
 import path from "node:path";
 import process from "node:process";
@@ -373,20 +373,29 @@ function getGlobalState() {
 }
 async function startCodexConversationThread(params) {
 	const workspaceDir = params.workspaceDir?.trim() || resolveCodexDefaultWorkspaceDir(params.pluginConfig);
+	const existingBinding = await readCodexAppServerBinding(params.sessionFile, { config: params.config });
+	const authProfileId = resolveCodexAppServerAuthProfileIdForAgent({
+		authProfileId: params.authProfileId ?? existingBinding?.authProfileId,
+		config: params.config
+	});
 	if (params.threadId?.trim()) await attachExistingThread({
 		pluginConfig: params.pluginConfig,
 		sessionFile: params.sessionFile,
 		threadId: params.threadId.trim(),
 		workspaceDir,
 		model: params.model,
-		modelProvider: params.modelProvider
+		modelProvider: params.modelProvider,
+		authProfileId,
+		config: params.config
 	});
 	else await createThread({
 		pluginConfig: params.pluginConfig,
 		sessionFile: params.sessionFile,
 		workspaceDir,
 		model: params.model,
-		modelProvider: params.modelProvider
+		modelProvider: params.modelProvider,
+		authProfileId,
+		config: params.config
 	});
 	return createCodexConversationBindingData({
 		sessionFile: params.sessionFile,
@@ -425,13 +434,19 @@ async function handleCodexConversationBindingResolved(event) {
 }
 async function attachExistingThread(params) {
 	const runtime = resolveCodexAppServerRuntimeOptions({ pluginConfig: params.pluginConfig });
+	const modelProvider = resolveThreadRequestModelProvider({
+		authProfileId: params.authProfileId,
+		modelProvider: params.modelProvider,
+		config: params.config
+	});
 	const response = await (await getSharedCodexAppServerClient({
 		startOptions: runtime.start,
-		timeoutMs: runtime.requestTimeoutMs
+		timeoutMs: runtime.requestTimeoutMs,
+		authProfileId: params.authProfileId
 	})).request(CODEX_CONTROL_METHODS.resumeThread, {
 		threadId: params.threadId,
 		...params.model ? { model: params.model } : {},
-		...params.modelProvider ? { modelProvider: params.modelProvider } : {},
+		...modelProvider ? { modelProvider } : {},
 		approvalPolicy: runtime.approvalPolicy,
 		approvalsReviewer: runtime.approvalsReviewer,
 		sandbox: runtime.sandbox,
@@ -442,22 +457,33 @@ async function attachExistingThread(params) {
 	await writeCodexAppServerBinding(params.sessionFile, {
 		threadId: thread.id,
 		cwd: thread.cwd ?? params.workspaceDir,
+		authProfileId: params.authProfileId,
 		model: response.model ?? params.model,
-		modelProvider: response.modelProvider ?? params.modelProvider,
+		modelProvider: normalizeCodexAppServerBindingModelProvider({
+			config: params.config,
+			authProfileId: params.authProfileId,
+			modelProvider: response.modelProvider ?? params.modelProvider
+		}),
 		approvalPolicy: runtime.approvalPolicy,
 		sandbox: runtime.sandbox,
 		serviceTier: runtime.serviceTier
-	});
+	}, { config: params.config });
 }
 async function createThread(params) {
 	const runtime = resolveCodexAppServerRuntimeOptions({ pluginConfig: params.pluginConfig });
+	const modelProvider = resolveThreadRequestModelProvider({
+		authProfileId: params.authProfileId,
+		modelProvider: params.modelProvider,
+		config: params.config
+	});
 	const response = await (await getSharedCodexAppServerClient({
 		startOptions: runtime.start,
-		timeoutMs: runtime.requestTimeoutMs
+		timeoutMs: runtime.requestTimeoutMs,
+		authProfileId: params.authProfileId
 	})).request("thread/start", {
 		cwd: params.workspaceDir,
 		...params.model ? { model: params.model } : {},
-		...params.modelProvider ? { modelProvider: params.modelProvider } : {},
+		...modelProvider ? { modelProvider } : {},
 		approvalPolicy: runtime.approvalPolicy,
 		approvalsReviewer: runtime.approvalsReviewer,
 		sandbox: runtime.sandbox,
@@ -469,12 +495,17 @@ async function createThread(params) {
 	await writeCodexAppServerBinding(params.sessionFile, {
 		threadId: response.thread.id,
 		cwd: response.thread.cwd ?? params.workspaceDir,
+		authProfileId: params.authProfileId,
 		model: response.model ?? params.model,
-		modelProvider: response.modelProvider ?? params.modelProvider,
+		modelProvider: normalizeCodexAppServerBindingModelProvider({
+			config: params.config,
+			authProfileId: params.authProfileId,
+			modelProvider: response.modelProvider ?? params.modelProvider
+		}),
 		approvalPolicy: runtime.approvalPolicy,
 		sandbox: runtime.sandbox,
 		serviceTier: runtime.serviceTier
-	});
+	}, { config: params.config });
 }
 async function runBoundTurn(params) {
 	const runtime = resolveCodexAppServerRuntimeOptions({ pluginConfig: params.pluginConfig });
@@ -542,8 +573,14 @@ function enqueueBoundTurn(key, run) {
 	state.queues.set(key, queued);
 	next.finally(() => {
 		if (state.queues.get(key) === queued) state.queues.delete(key);
-	});
+	}).catch(() => void 0);
 	return next;
 }
+function resolveThreadRequestModelProvider(params) {
+	const modelProvider = params.modelProvider?.trim();
+	if (!modelProvider || modelProvider.toLowerCase() === "codex") return;
+	if (isCodexAppServerNativeAuthProfile(params) && (modelProvider.toLowerCase() === "openai" || modelProvider.toLowerCase() === "openai-codex")) return;
+	return modelProvider.toLowerCase() === "openai-codex" ? "openai" : modelProvider;
+}
 //#endregion
 export { parseCodexFastModeArg as a, setCodexConversationFastMode as c, steerCodexConversationTurn as d, stopCodexConversationTurn as f, formatPermissionsMode as i, setCodexConversationModel as l, resolveCodexDefaultWorkspaceDir as m, handleCodexConversationInboundClaim as n, parseCodexPermissionsModeArg as o, readCodexConversationBindingData as p, startCodexConversationThread as r, readCodexConversationActiveTurn as s, handleCodexConversationBindingResolved as t, setCodexConversationPermissions as u };

package/dist/harness.js

@@ -18,21 +18,21 @@ function createCodexAppServerAgentHarness(options) {
 			};
 		},
 		runAttempt: async (params) => {
-			const { runCodexAppServerAttempt } = await import("./run-attempt-C5v380B8.js");
+			const { runCodexAppServerAttempt } = await import("./run-attempt-BNbVe-IG.js");
 			return runCodexAppServerAttempt(params, { pluginConfig: options?.pluginConfig });
 		},
 		compact: async (params) => {
-			const { maybeCompactCodexAppServerSession } = await import("./compact-CpZ5DNlM.js");
+			const { maybeCompactCodexAppServerSession } = await import("./compact-C0_rGlHZ.js");
 			return maybeCompactCodexAppServerSession(params, { pluginConfig: options?.pluginConfig });
 		},
 		reset: async (params) => {
 			if (params.sessionFile) {
-				const { clearCodexAppServerBinding } = await import("./session-binding-C7Y7rY0i.js").then((n) => n.r);
+				const { clearCodexAppServerBinding } = await import("./session-binding-DuJYTJQy.js").then((n) => n.a);
 				await clearCodexAppServerBinding(params.sessionFile);
 			}
 		},
 		dispose: async () => {
-			const { clearSharedCodexAppServerClientAndWait } = await import("./shared-client-DEzBJ9G1.js").then((n) => n.r);
+			const { clearSharedCodexAppServerClientAndWait } = await import("./shared-client-0El8eRIE.js").then((n) => n.r);
 			await clearSharedCodexAppServerClientAndWait();
 		}
 	};

package/dist/index.js

@@ -1,7 +1,7 @@
 import { createCodexAppServerAgentHarness } from "./harness.js";
 import { buildCodexMediaUnderstandingProvider } from "./media-understanding-provider.js";
 import { buildCodexProvider } from "./provider.js";
-import { n as handleCodexConversationInboundClaim, t as handleCodexConversationBindingResolved } from "./conversation-binding-D12ISGdf.js";
+import { n as handleCodexConversationInboundClaim, t as handleCodexConversationBindingResolved } from "./conversation-binding-DjptpT9W.js";
 import { resolveLivePluginConfigObject } from "openclaw/plugin-sdk/plugin-config-runtime";
 import { definePluginEntry } from "openclaw/plugin-sdk/plugin-entry";
 import fs from "node:fs/promises";
@@ -23,7 +23,7 @@ function createCodexCommand(options) {
 	};
 }
 async function handleCodexCommand(ctx, options = {}) {
-	const { handleCodexSubcommand } = await import("./command-handlers-Dxx2slu2.js");
+	const { handleCodexSubcommand } = await import("./command-handlers-CeaXhO5y.js");
 	return await handleCodexSubcommand(ctx, options);
 }
 //#endregion

package/dist/media-understanding-provider.js

@@ -1,7 +1,7 @@
 import { CODEX_PROVIDER_ID, FALLBACK_CODEX_MODELS } from "./provider-catalog.js";
 import { i as resolveCodexAppServerRuntimeOptions } from "./config-CkkoMeqF.js";
 import { a as readCodexErrorNotification, c as readCodexTurnCompletedNotification, n as assertCodexThreadStartResponse, r as assertCodexTurnStartResponse } from "./protocol-validators-Cpopom3_.js";
-import { i as readModelListResult } from "./models-Ddmxtdog.js";
+import { i as readModelListResult } from "./models-Ds7g6191.js";
 import { t as isJsonObject } from "./protocol-C9UWI98H.js";
 //#region extensions/codex/media-understanding-provider.ts
 const DEFAULT_CODEX_IMAGE_MODEL = FALLBACK_CODEX_MODELS.find((model) => model.inputModalities.includes("image"))?.id ?? FALLBACK_CODEX_MODELS[0]?.id;
@@ -37,7 +37,7 @@ async function describeCodexImages(req, options) {
 	const appServer = resolveCodexAppServerRuntimeOptions({ pluginConfig: options.pluginConfig });
 	const timeoutMs = Math.max(100, req.timeoutMs);
 	const ownsClient = !options.clientFactory;
-	const client = options.clientFactory ? await options.clientFactory(appServer.start, req.profile) : await import("./shared-client-DEzBJ9G1.js").then((n) => n.r).then(({ createIsolatedCodexAppServerClient }) => createIsolatedCodexAppServerClient({
+	const client = options.clientFactory ? await options.clientFactory(appServer.start, req.profile) : await import("./shared-client-0El8eRIE.js").then((n) => n.r).then(({ createIsolatedCodexAppServerClient }) => createIsolatedCodexAppServerClient({
 		startOptions: appServer.start,
 		timeoutMs,
 		authProfileId: req.profile

package/dist/{models-Ddmxtdog.js → models-Ds7g6191.js}

@@ -39,7 +39,7 @@ async function listAllCodexAppServerModels(options = {}) {
 async function withCodexAppServerModelClient(options, run) {
 	const timeoutMs = options.timeoutMs ?? 2500;
 	const useSharedClient = options.sharedClient !== false;
-	const { createIsolatedCodexAppServerClient, getSharedCodexAppServerClient } = await import("./shared-client-DEzBJ9G1.js").then((n) => n.r);
+	const { createIsolatedCodexAppServerClient, getSharedCodexAppServerClient } = await import("./shared-client-0El8eRIE.js").then((n) => n.r);
 	const client = useSharedClient ? await getSharedCodexAppServerClient({
 		startOptions: options.startOptions,
 		timeoutMs,

package/dist/provider.js

@@ -123,7 +123,7 @@ async function listModelsBestEffort(params) {
 	}
 }
 async function listCodexAppServerModelsLazy(options) {
-	const { listCodexAppServerModels } = await import("./models-Ddmxtdog.js").then((n) => n.r);
+	const { listCodexAppServerModels } = await import("./models-Ds7g6191.js").then((n) => n.r);
 	return listCodexAppServerModels(options);
 }
 function normalizeTimeoutMs(value) {

package/dist/{run-attempt-C5v380B8.js → run-attempt-BNbVe-IG.js}

@@ -1,12 +1,12 @@
 import { i as resolveCodexAppServerRuntimeOptions, r as readCodexPluginConfig } from "./config-CkkoMeqF.js";
 import { i as readCodexDynamicToolCallParams, r as assertCodexTurnStartResponse, s as readCodexTurn } from "./protocol-validators-Cpopom3_.js";
 import { t as isJsonObject } from "./protocol-C9UWI98H.js";
-import { i as isCodexAppServerConnectionClosedError, r as isCodexAppServerApprovalRequest } from "./client-Bm5-MMSf.js";
-import { n as readCodexAppServerBinding } from "./session-binding-C7Y7rY0i.js";
-import { a as refreshCodexAppServerAuthTokens, t as clearSharedCodexAppServerClientIfCurrent } from "./shared-client-DEzBJ9G1.js";
-import { a as startOrResumeThread, i as buildTurnStartParams, o as createCodexDynamicToolBridge, s as applyCodexDynamicToolProfile, t as buildDeveloperInstructions } from "./thread-lifecycle-BKZiIxyU.js";
-import { n as defaultCodexAppServerClientFactory, t as createCodexAppServerClientFactoryTestHooks } from "./client-factory-Bh5chnqU.js";
-import { t as ensureCodexComputerUse } from "./computer-use-BblypQuj.js";
+import { i as isCodexAppServerConnectionClosedError, r as isCodexAppServerApprovalRequest } from "./client-chGfNrq5.js";
+import { a as refreshCodexAppServerAuthTokens, o as resolveCodexAppServerAuthProfileId, s as resolveCodexAppServerAuthProfileIdForAgent, t as clearSharedCodexAppServerClientIfCurrent } from "./shared-client-0El8eRIE.js";
+import { i as readCodexAppServerBinding } from "./session-binding-DuJYTJQy.js";
+import { a as startOrResumeThread, i as buildTurnStartParams, o as createCodexDynamicToolBridge, s as applyCodexDynamicToolProfile, t as buildDeveloperInstructions } from "./thread-lifecycle-OAlp5Pku.js";
+import { n as defaultCodexAppServerClientFactory, t as createCodexAppServerClientFactoryTestHooks } from "./client-factory-MaOMEltT.js";
+import { t as ensureCodexComputerUse } from "./computer-use-amNk2zrB.js";
 import { createHash } from "node:crypto";
 import { TOOL_PROGRESS_OUTPUT_MAX_CHARS, acquireSessionWriteLock, appendSessionTranscriptMessage, assembleHarnessContextEngine, bootstrapHarnessContextEngine, buildEmbeddedAttemptToolRunContext, buildHarnessContextEngineRuntimeContext, buildHarnessContextEngineRuntimeContextFromUsage, callGatewayTool, classifyAgentHarnessTerminalOutcome, clearActiveEmbeddedRun, embeddedAgentLog, emitAgentEvent, emitSessionTranscriptUpdate, finalizeHarnessContextEngineTurn, formatApprovalDisplayPath, formatErrorMessage, formatToolAggregate, formatToolProgressOutput, inferToolMetaFromArgs, isActiveHarnessContextEngine, isSubagentSessionKey, normalizeAgentRuntimeTools, normalizeUsage, registerNativeHookRelay, resolveAgentHarnessBeforePromptBuildResult, resolveAttemptSpawnWorkspaceDir, resolveBootstrapContextForRun, resolveModelAuthMode, resolveOpenClawAgentDir, resolveSandboxContext, resolveSessionAgentIds, resolveSessionWriteLockAcquireTimeoutMs, resolveUserPath, runAgentCleanupStep, runAgentHarnessAfterCompactionHook, runAgentHarnessAgentEndHook, runAgentHarnessBeforeCompactionHook, runAgentHarnessBeforeMessageWriteHook, runAgentHarnessLlmInputHook, runAgentHarnessLlmOutputHook, runHarnessContextEngineMaintenance, setActiveEmbeddedRun, supportsModelTools } from "openclaw/plugin-sdk/agent-harness-runtime";
 import fs from "node:fs/promises";
@@ -2428,14 +2428,24 @@ async function runCodexAppServerAttempt(params, options = {}) {
 		agentId: params.agentId
 	});
 	const agentDir = params.agentDir ?? resolveOpenClawAgentDir();
+	const startupBinding = await readCodexAppServerBinding(params.sessionFile);
+	const startupAuthProfileCandidate = params.runtimePlan?.auth.forwardedAuthProfileId ?? params.authProfileId ?? startupBinding?.authProfileId;
+	const startupAuthProfileId = params.authProfileStore ? resolveCodexAppServerAuthProfileId({
+		authProfileId: startupAuthProfileCandidate,
+		store: params.authProfileStore,
+		config: params.config
+	}) : resolveCodexAppServerAuthProfileIdForAgent({
+		authProfileId: startupAuthProfileCandidate,
+		agentDir,
+		config: params.config
+	});
 	const runtimeParams = {
 		...params,
-		sessionKey: sandboxSessionKey
+		sessionKey: sandboxSessionKey,
+		...startupAuthProfileId ? { authProfileId: startupAuthProfileId } : {}
 	};
 	const activeContextEngine = isActiveHarnessContextEngine(params.contextEngine) ? params.contextEngine : void 0;
 	let yieldDetected = false;
-	const startupBinding = await readCodexAppServerBinding(params.sessionFile);
-	const startupAuthProfileId = params.runtimePlan?.auth.forwardedAuthProfileId ?? params.authProfileId ?? startupBinding?.authProfileId;
 	const toolBridge = createCodexDynamicToolBridge({
 		tools: await buildDynamicTools({
 			params,
@@ -2581,7 +2591,7 @@ async function runCodexAppServerAttempt(params, options = {}) {
 						client: startupClient,
 						thread: await startOrResumeThread({
 							client: startupClient,
-							params,
+							params: runtimeParams,
 							cwd: effectiveWorkspace,
 							dynamicTools: toolBridge.specs,
 							appServer,

package/dist/{session-binding-C7Y7rY0i.js → session-binding-DuJYTJQy.js}

@@ -1,17 +1,22 @@
 import { t as __exportAll } from "./rolldown-runtime-DUslC3ob.js";
 import { embeddedAgentLog } from "openclaw/plugin-sdk/agent-harness-runtime";
 import fs from "node:fs/promises";
+import { ensureAuthProfileStore, resolveOpenClawAgentDir as resolveOpenClawAgentDir$1, resolveProviderIdForAuth } from "openclaw/plugin-sdk/agent-runtime";
 //#region extensions/codex/src/app-server/session-binding.ts
 var session_binding_exports = /* @__PURE__ */ __exportAll({
 	clearCodexAppServerBinding: () => clearCodexAppServerBinding,
+	isCodexAppServerNativeAuthProfile: () => isCodexAppServerNativeAuthProfile,
+	normalizeCodexAppServerBindingModelProvider: () => normalizeCodexAppServerBindingModelProvider,
 	readCodexAppServerBinding: () => readCodexAppServerBinding,
 	resolveCodexAppServerBindingPath: () => resolveCodexAppServerBindingPath,
 	writeCodexAppServerBinding: () => writeCodexAppServerBinding
 });
+const CODEX_APP_SERVER_NATIVE_AUTH_PROVIDER = "openai-codex";
+const PUBLIC_OPENAI_MODEL_PROVIDER = "openai";
 function resolveCodexAppServerBindingPath(sessionFile) {
 	return `${sessionFile}.codex-app-server.json`;
 }
-async function readCodexAppServerBinding(sessionFile) {
+async function readCodexAppServerBinding(sessionFile, lookup = {}) {
 	const path = resolveCodexAppServerBindingPath(sessionFile);
 	let raw;
 	try {
@@ -27,14 +32,19 @@ async function readCodexAppServerBinding(sessionFile) {
 	try {
 		const parsed = JSON.parse(raw);
 		if (parsed.schemaVersion !== 1 || typeof parsed.threadId !== "string") return;
+		const authProfileId = typeof parsed.authProfileId === "string" ? parsed.authProfileId : void 0;
 		return {
 			schemaVersion: 1,
 			threadId: parsed.threadId,
 			sessionFile,
 			cwd: typeof parsed.cwd === "string" ? parsed.cwd : "",
-			authProfileId: typeof parsed.authProfileId === "string" ? parsed.authProfileId : void 0,
+			authProfileId,
 			model: typeof parsed.model === "string" ? parsed.model : void 0,
-			modelProvider: typeof parsed.modelProvider === "string" ? parsed.modelProvider : void 0,
+			modelProvider: normalizeCodexAppServerBindingModelProvider({
+				...lookup,
+				authProfileId,
+				modelProvider: typeof parsed.modelProvider === "string" ? parsed.modelProvider : void 0
+			}),
 			approvalPolicy: readApprovalPolicy(parsed.approvalPolicy),
 			sandbox: readSandboxMode(parsed.sandbox),
 			serviceTier: readServiceTier(parsed.serviceTier),
@@ -50,7 +60,7 @@ async function readCodexAppServerBinding(sessionFile) {
 		return;
 	}
 }
-async function writeCodexAppServerBinding(sessionFile, binding) {
+async function writeCodexAppServerBinding(sessionFile, binding, lookup = {}) {
 	const now = (/* @__PURE__ */ new Date()).toISOString();
 	const payload = {
 		schemaVersion: 1,
@@ -59,7 +69,11 @@ async function writeCodexAppServerBinding(sessionFile, binding) {
 		cwd: binding.cwd,
 		authProfileId: binding.authProfileId,
 		model: binding.model,
-		modelProvider: binding.modelProvider,
+		modelProvider: normalizeCodexAppServerBindingModelProvider({
+			...lookup,
+			authProfileId: binding.authProfileId,
+			modelProvider: binding.modelProvider
+		}),
 		approvalPolicy: binding.approvalPolicy,
 		sandbox: binding.sandbox,
 		serviceTier: binding.serviceTier,
@@ -82,6 +96,43 @@ async function clearCodexAppServerBinding(sessionFile) {
 function isNotFound(error) {
 	return Boolean(error && typeof error === "object" && "code" in error && error.code === "ENOENT");
 }
+function isCodexAppServerNativeAuthProfile(lookup) {
+	const authProfileId = lookup.authProfileId?.trim();
+	if (!authProfileId) return false;
+	try {
+		return isCodexAppServerNativeAuthProvider({
+			provider: resolveCodexAppServerAuthProfileCredential({
+				...lookup,
+				authProfileId
+			})?.provider,
+			config: lookup.config
+		});
+	} catch (error) {
+		embeddedAgentLog.debug("failed to resolve codex app-server auth profile provider", {
+			authProfileId,
+			error
+		});
+		return false;
+	}
+}
+function normalizeCodexAppServerBindingModelProvider(params) {
+	const modelProvider = params.modelProvider?.trim();
+	if (!modelProvider) return;
+	if (isCodexAppServerNativeAuthProfile(params) && modelProvider.toLowerCase() === PUBLIC_OPENAI_MODEL_PROVIDER) return;
+	return modelProvider;
+}
+function resolveCodexAppServerAuthProfileCredential(lookup) {
+	const authProfileId = lookup.authProfileId?.trim();
+	if (!authProfileId) return;
+	return (lookup.authProfileStore ?? loadCodexAppServerAuthProfileStore(lookup.agentDir)).profiles[authProfileId];
+}
+function loadCodexAppServerAuthProfileStore(agentDir) {
+	return ensureAuthProfileStore(agentDir?.trim() || resolveOpenClawAgentDir$1(), { allowKeychainPrompt: false });
+}
+function isCodexAppServerNativeAuthProvider(params) {
+	const provider = params.provider?.trim();
+	return Boolean(provider && resolveProviderIdForAuth(provider, { config: params.config }) === CODEX_APP_SERVER_NATIVE_AUTH_PROVIDER);
+}
 function readApprovalPolicy(value) {
 	return value === "never" || value === "on-request" || value === "on-failure" || value === "untrusted" ? value : void 0;
 }
@@ -92,4 +143,4 @@ function readServiceTier(value) {
 	return value === "fast" || value === "flex" ? value : void 0;
 }
 //#endregion
-export { writeCodexAppServerBinding as i, readCodexAppServerBinding as n, session_binding_exports as r, clearCodexAppServerBinding as t };
+export { session_binding_exports as a, readCodexAppServerBinding as i, isCodexAppServerNativeAuthProfile as n, writeCodexAppServerBinding as o, normalizeCodexAppServerBindingModelProvider as r, clearCodexAppServerBinding as t };

package/dist/{shared-client-DEzBJ9G1.js → shared-client-0El8eRIE.js}

@@ -1,11 +1,11 @@
 import { t as __exportAll } from "./rolldown-runtime-DUslC3ob.js";
 import { i as resolveCodexAppServerRuntimeOptions, t as codexAppServerStartOptionsKey } from "./config-CkkoMeqF.js";
-import { a as MANAGED_CODEX_APP_SERVER_PACKAGE, o as resolveCodexAppServerSpawnEnv, t as CodexAppServerClient } from "./client-Bm5-MMSf.js";
+import { a as MANAGED_CODEX_APP_SERVER_PACKAGE, o as resolveCodexAppServerSpawnEnv, t as CodexAppServerClient } from "./client-chGfNrq5.js";
 import { createRequire } from "node:module";
 import fs, { access } from "node:fs/promises";
-import { resolveOpenClawAgentDir } from "openclaw/plugin-sdk/provider-auth";
 import path from "node:path";
-import { ensureAuthProfileStore, loadAuthProfileStoreForSecretsRuntime, resolveApiKeyForProfile, resolvePersistedAuthProfileOwnerAgentDir, resolveProviderIdForAuth, saveAuthProfileStore } from "openclaw/plugin-sdk/agent-runtime";
+import { ensureAuthProfileStore, loadAuthProfileStoreForSecretsRuntime, resolveApiKeyForProfile, resolveAuthProfileOrder, resolveOpenClawAgentDir, resolvePersistedAuthProfileOwnerAgentDir, resolveProviderIdForAuth, saveAuthProfileStore } from "openclaw/plugin-sdk/agent-runtime";
+import { resolveOpenClawAgentDir as resolveOpenClawAgentDir$1 } from "openclaw/plugin-sdk/provider-auth";
 import { constants, readFileSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 //#region extensions/codex/src/app-server/auth-bridge.ts
@@ -20,11 +20,32 @@ const CODEX_APP_SERVER_ISOLATION_ENV_VARS = [CODEX_HOME_ENV_VAR, HOME_ENV_VAR];
 async function bridgeCodexAppServerStartOptions(params) {
 	if (params.startOptions.transport !== "stdio") return params.startOptions;
 	const isolatedStartOptions = await withAgentCodexHomeEnvironment(params.startOptions, params.agentDir);
+	const store = ensureAuthProfileStore(params.agentDir, { allowKeychainPrompt: false });
 	return shouldClearOpenAiApiKeyForCodexAuthProfile({
-		store: ensureAuthProfileStore(params.agentDir, { allowKeychainPrompt: false }),
-		authProfileId: params.authProfileId
+		store,
+		authProfileId: resolveCodexAppServerAuthProfileId({
+			authProfileId: params.authProfileId,
+			store
+		})
 	}) ? withClearedEnvironmentVariables(isolatedStartOptions, CODEX_APP_SERVER_API_KEY_ENV_VARS) : isolatedStartOptions;
 }
+function resolveCodexAppServerAuthProfileId(params) {
+	const requested = params.authProfileId?.trim();
+	if (requested) return requested;
+	return resolveAuthProfileOrder({
+		cfg: params.config,
+		store: params.store,
+		provider: CODEX_APP_SERVER_AUTH_PROVIDER
+	})[0]?.trim();
+}
+function resolveCodexAppServerAuthProfileIdForAgent(params) {
+	const store = ensureAuthProfileStore(params.agentDir?.trim() || resolveOpenClawAgentDir(), { allowKeychainPrompt: false });
+	return resolveCodexAppServerAuthProfileId({
+		authProfileId: params.authProfileId,
+		store,
+		config: params.config
+	});
+}
 function resolveCodexAppServerHomeDir(agentDir) {
 	return path.join(path.resolve(agentDir), CODEX_APP_SERVER_HOME_DIRNAME);
 }
@@ -85,9 +106,13 @@ async function refreshCodexAppServerAuthTokens(params) {
 	};
 }
 async function resolveCodexAppServerAuthProfileLoginParamsInternal(params) {
-	const profileId = params.authProfileId?.trim();
+	const store = ensureAuthProfileStore(params.agentDir, { allowKeychainPrompt: false });
+	const profileId = resolveCodexAppServerAuthProfileId({
+		authProfileId: params.authProfileId,
+		store
+	});
 	if (!profileId) return;
-	const credential = ensureAuthProfileStore(params.agentDir, { allowKeychainPrompt: false }).profiles[profileId];
+	const credential = store.profiles[profileId];
 	if (!credential) throw new Error(`Codex app-server auth profile "${profileId}" was not found.`);
 	if (!isCodexAppServerAuthProvider(credential.provider)) throw new Error(`Codex app-server auth profile "${profileId}" must belong to provider "openai-codex" or a supported alias.`);
 	const loginParams = await resolveLoginParamsForCredential(profileId, credential, {
@@ -336,7 +361,7 @@ function getSharedCodexAppServerClientState() {
 }
 async function getSharedCodexAppServerClient(options) {
 	const state = getSharedCodexAppServerClientState();
-	const agentDir = options?.agentDir ?? resolveOpenClawAgentDir();
+	const agentDir = options?.agentDir ?? resolveOpenClawAgentDir$1();
 	const startOptions = await bridgeCodexAppServerStartOptions({
 		startOptions: await resolveManagedCodexAppServerStartOptions(options?.startOptions ?? resolveCodexAppServerRuntimeOptions().start),
 		agentDir,
@@ -374,7 +399,7 @@ async function getSharedCodexAppServerClient(options) {
 	}
 }
 async function createIsolatedCodexAppServerClient(options) {
-	const agentDir = options?.agentDir ?? resolveOpenClawAgentDir();
+	const agentDir = options?.agentDir ?? resolveOpenClawAgentDir$1();
 	const startOptions = await bridgeCodexAppServerStartOptions({
 		startOptions: await resolveManagedCodexAppServerStartOptions(options?.startOptions ?? resolveCodexAppServerRuntimeOptions().start),
 		agentDir,
@@ -431,4 +456,4 @@ function clearSharedClientIfCurrent(client) {
 	state.key = void 0;
 }
 //#endregion
-export { refreshCodexAppServerAuthTokens as a, withTimeout as i, getSharedCodexAppServerClient as n, shared_client_exports as r, clearSharedCodexAppServerClientIfCurrent as t };
+export { refreshCodexAppServerAuthTokens as a, withTimeout as i, getSharedCodexAppServerClient as n, resolveCodexAppServerAuthProfileId as o, shared_client_exports as r, resolveCodexAppServerAuthProfileIdForAgent as s, clearSharedCodexAppServerClientIfCurrent as t };

package/dist/test-api.js

@@ -1,5 +1,5 @@
 import { i as resolveCodexAppServerRuntimeOptions } from "./config-CkkoMeqF.js";
-import { i as buildTurnStartParams, n as buildThreadResumeParams, o as createCodexDynamicToolBridge, r as buildThreadStartParams, s as applyCodexDynamicToolProfile, t as buildDeveloperInstructions } from "./thread-lifecycle-BKZiIxyU.js";
+import { i as buildTurnStartParams, n as buildThreadResumeParams, o as createCodexDynamicToolBridge, r as buildThreadStartParams, s as applyCodexDynamicToolProfile, t as buildDeveloperInstructions } from "./thread-lifecycle-OAlp5Pku.js";
 //#region extensions/codex/test-api.ts
 function resolveCodexPromptSnapshotAppServerOptions(pluginConfig) {
 	return resolveCodexAppServerRuntimeOptions({

package/dist/{thread-lifecycle-BKZiIxyU.js → thread-lifecycle-OAlp5Pku.js}

@@ -3,8 +3,8 @@ import { n as assertCodexThreadStartResponse, t as assertCodexThreadResumeRespon
 import { t as isJsonObject } from "./protocol-C9UWI98H.js";
 import { CODEX_GPT5_HEARTBEAT_PROMPT_OVERLAY, renderCodexPromptOverlay } from "./prompt-overlay.js";
 import { isModernCodexModel } from "./provider.js";
-import { i as isCodexAppServerConnectionClosedError } from "./client-Bm5-MMSf.js";
-import { i as writeCodexAppServerBinding, n as readCodexAppServerBinding, t as clearCodexAppServerBinding } from "./session-binding-C7Y7rY0i.js";
+import { i as isCodexAppServerConnectionClosedError } from "./client-chGfNrq5.js";
+import { i as readCodexAppServerBinding, n as isCodexAppServerNativeAuthProfile, o as writeCodexAppServerBinding, t as clearCodexAppServerBinding } from "./session-binding-DuJYTJQy.js";
 import { HEARTBEAT_RESPONSE_TOOL_NAME, createAgentToolResultMiddlewareRunner, createCodexAppServerToolResultExtensionRunner, embeddedAgentLog, extractToolResultMediaArtifact, filterToolResultMediaUrls, isMessagingTool, isMessagingToolSendAction, isToolWrappedWithBeforeToolCallHook, normalizeHeartbeatToolResponse, runAgentHarnessAfterToolCallHook, wrapToolWithBeforeToolCallHook } from "openclaw/plugin-sdk/agent-harness-runtime";
 //#region extensions/codex/src/app-server/dynamic-tool-profile.ts
 const CODEX_NATIVE_FIRST_DYNAMIC_TOOL_EXCLUDES = [
@@ -260,19 +260,31 @@ function isCronAddAction(args) {
 //#region extensions/codex/src/app-server/thread-lifecycle.ts
 async function startOrResumeThread(params) {
 	const dynamicToolsFingerprint = fingerprintDynamicTools(params.dynamicTools);
-	const binding = await readCodexAppServerBinding(params.params.sessionFile);
+	const binding = await readCodexAppServerBinding(params.params.sessionFile, {
+		authProfileStore: params.params.authProfileStore,
+		agentDir: params.params.agentDir,
+		config: params.params.config
+	});
 	if (binding?.threadId) if (binding.dynamicToolsFingerprint && binding.dynamicToolsFingerprint !== dynamicToolsFingerprint) {
 		embeddedAgentLog.debug("codex app-server dynamic tool catalog changed; starting a new thread", { threadId: binding.threadId });
 		await clearCodexAppServerBinding(params.params.sessionFile);
 	} else try {
+		const authProfileId = params.params.authProfileId ?? binding.authProfileId;
 		const response = assertCodexThreadResumeResponse(await params.client.request("thread/resume", buildThreadResumeParams(params.params, {
 			threadId: binding.threadId,
+			authProfileId,
 			appServer: params.appServer,
 			developerInstructions: params.developerInstructions,
 			config: params.config
 		})));
-		const boundAuthProfileId = params.params.authProfileId ?? binding.authProfileId;
-		const fallbackModelProvider = resolveCodexAppServerModelProvider(params.params.provider);
+		const boundAuthProfileId = authProfileId;
+		const fallbackModelProvider = resolveCodexAppServerModelProvider({
+			provider: params.params.provider,
+			authProfileId: boundAuthProfileId,
+			authProfileStore: params.params.authProfileStore,
+			agentDir: params.params.agentDir,
+			config: params.params.config
+		});
 		await writeCodexAppServerBinding(params.params.sessionFile, {
 			threadId: response.thread.id,
 			cwd: params.cwd,
@@ -281,6 +293,10 @@ async function startOrResumeThread(params) {
 			modelProvider: response.modelProvider ?? fallbackModelProvider,
 			dynamicToolsFingerprint,
 			createdAt: binding.createdAt
+		}, {
+			authProfileStore: params.params.authProfileStore,
+			agentDir: params.params.agentDir,
+			config: params.params.config
 		});
 		return {
 			...binding,
@@ -303,7 +319,13 @@ async function startOrResumeThread(params) {
 		developerInstructions: params.developerInstructions,
 		config: params.config
 	})));
-	const modelProvider = resolveCodexAppServerModelProvider(params.params.provider);
+	const modelProvider = resolveCodexAppServerModelProvider({
+		provider: params.params.provider,
+		authProfileId: params.params.authProfileId,
+		authProfileStore: params.params.authProfileStore,
+		agentDir: params.params.agentDir,
+		config: params.params.config
+	});
 	const createdAt = (/* @__PURE__ */ new Date()).toISOString();
 	await writeCodexAppServerBinding(params.params.sessionFile, {
 		threadId: response.thread.id,
@@ -313,6 +335,10 @@ async function startOrResumeThread(params) {
 		modelProvider: response.modelProvider ?? modelProvider,
 		dynamicToolsFingerprint,
 		createdAt
+	}, {
+		authProfileStore: params.params.authProfileStore,
+		agentDir: params.params.agentDir,
+		config: params.params.config
 	});
 	return {
 		schemaVersion: 1,
@@ -328,7 +354,13 @@ async function startOrResumeThread(params) {
 	};
 }
 function buildThreadStartParams(params, options) {
-	const modelProvider = resolveCodexAppServerModelProvider(params.provider);
+	const modelProvider = resolveCodexAppServerModelProvider({
+		provider: params.provider,
+		authProfileId: params.authProfileId,
+		authProfileStore: params.authProfileStore,
+		agentDir: params.agentDir,
+		config: params.config
+	});
 	return {
 		model: params.modelId,
 		...modelProvider ? { modelProvider } : {},
@@ -346,7 +378,13 @@ function buildThreadStartParams(params, options) {
 	};
 }
 function buildThreadResumeParams(params, options) {
-	const modelProvider = resolveCodexAppServerModelProvider(params.provider);
+	const modelProvider = resolveCodexAppServerModelProvider({
+		provider: params.provider,
+		authProfileId: options.authProfileId ?? params.authProfileId,
+		authProfileStore: params.authProfileStore,
+		agentDir: params.agentDir,
+		config: params.config
+	});
 	return {
 		threadId: options.threadId,
 		model: params.modelId,
@@ -446,10 +484,12 @@ function buildUserInput(params, promptText = params.prompt) {
 		url: `data:${image.mimeType};base64,${image.data}`
 	}))];
 }
-function resolveCodexAppServerModelProvider(provider) {
-	const normalized = provider.trim();
-	if (!normalized || normalized === "codex") return;
-	return normalized === "openai-codex" ? "openai" : normalized;
+function resolveCodexAppServerModelProvider(params) {
+	const normalized = params.provider.trim();
+	const normalizedLower = normalized.toLowerCase();
+	if (!normalized || normalizedLower === "codex") return;
+	if (isCodexAppServerNativeAuthProfile(params) && (normalizedLower === "openai" || normalizedLower === "openai-codex")) return;
+	return normalizedLower === "openai-codex" ? "openai" : normalized;
 }
 function resolveReasoningEffort(thinkLevel, modelId) {
 	if (thinkLevel === "minimal") return isModernCodexModel(modelId) ? "low" : "minimal";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openclaw/codex",
-  "version": "2026.5.3-beta.2",
+  "version": "2026.5.3-beta.4",
   "description": "OpenClaw Codex harness and model provider plugin",
   "repository": {
     "type": "git",
@@ -27,10 +27,10 @@
       "minHostVersion": ">=2026.5.1-beta.1"
     },
     "compat": {
-      "pluginApi": ">=2026.5.3-beta.2"
+      "pluginApi": ">=2026.5.3-beta.4"
     },
     "build": {
-      "openclawVersion": "2026.5.3-beta.2"
+      "openclawVersion": "2026.5.3-beta.4"
     },
     "release": {
       "publishToClawHub": true,
@@ -45,7 +45,7 @@
     "openclaw.plugin.json"
   ],
   "peerDependencies": {
-    "openclaw": ">=2026.5.3-beta.2"
+    "openclaw": ">=2026.5.3-beta.4"
   },
   "peerDependenciesMeta": {
     "openclaw": {

package/dist/{client-Bm5-MMSf.js → client-chGfNrq5.js}

@@ -1,9 +1,9 @@
 import { i as resolveCodexAppServerRuntimeOptions } from "./config-CkkoMeqF.js";
 import { n as isRpcResponse } from "./protocol-C9UWI98H.js";
 import { OPENCLAW_VERSION, embeddedAgentLog } from "openclaw/plugin-sdk/agent-harness-runtime";
-import { createInterface } from "node:readline";
 import { spawn } from "node:child_process";
 import { materializeWindowsSpawnProgram, resolveWindowsSpawnProgram } from "openclaw/plugin-sdk/windows-spawn";
+import { createInterface } from "node:readline";
 import { EventEmitter } from "node:events";
 import { PassThrough, Writable } from "node:stream";
 import WebSocket from "ws";