@openclaw/codex 2026.5.31-beta.3 → 2026.6.1-beta.1

package/dist/{client-factory-B8dh39UW.js → client-factory-DBgo1xC5.js}

@@ -1,7 +1,7 @@
 //#region extensions/codex/src/app-server/client-factory.ts
 let sharedClientModulePromise = null;
 const loadSharedClientModule = async () => {
-	sharedClientModulePromise ??= import("./shared-client-DBlR-rV2.js").then((n) => n.s);
+	sharedClientModulePromise ??= import("./shared-client-ByKKWtYX.js").then((n) => n.s);
 	return await sharedClientModulePromise;
 };
 const defaultCodexAppServerClientFactory = (startOptions, authProfileId, agentDir, config) => loadSharedClientModule().then(({ getSharedCodexAppServerClient }) => getSharedCodexAppServerClient({

package/dist/{command-handlers-B8-28KIp.js → command-handlers-BnVjvHTP.js}

@@ -1,12 +1,12 @@
 import { d as resolveCodexAppServerRuntimeOptions, o as isCodexFastServiceTier } from "./config-AlzuNKCY.js";
-import { n as listCodexAppServerModels, t as listAllCodexAppServerModels } from "./models-mbjSisZL.js";
+import { n as listCodexAppServerModels, t as listAllCodexAppServerModels } from "./models-DEgJXKQy.js";
 import { l as isJsonObject } from "./client-BnOmn0y-.js";
 import { a as readCodexAppServerBinding, s as writeCodexAppServerBinding, t as clearCodexAppServerBinding } from "./session-binding-BXJAV_xy.js";
-import { i as describeControlFailure, r as CODEX_CONTROL_METHODS, t as requestCodexAppServerJson } from "./request-DuFgTwRU.js";
+import { i as describeControlFailure, r as CODEX_CONTROL_METHODS, t as requestCodexAppServerJson } from "./request-DKdcodME.js";
 import { a as buildHelp, c as formatCodexStatus, d as formatModels, f as formatSkills, l as formatComputerUseStatus, m as readString$1, o as formatAccount, p as formatThreads, s as formatCodexDisplayText, u as formatList, v as summarizeCodexAccountUsage } from "./notification-correlation-BykOI_jh.js";
 import { n as resolveCodexNativeExecutionBlock, r as resolveCodexNativeSandboxBlock } from "./sandbox-guard-DMCJlzmz.js";
-import { _ as steerCodexConversationTurn, b as readCodexConversationBindingData, d as parseCodexFastModeArg, f as parseCodexPermissionsModeArg, g as setCodexConversationPermissions, h as setCodexConversationModel, m as setCodexConversationFastMode, o as formatCodexCliSessions, p as readCodexConversationActiveTurn, r as startCodexConversationThread, u as formatPermissionsMode, v as stopCodexConversationTurn, x as resolveCodexDefaultWorkspaceDir, y as createCodexCliNodeConversationBindingData } from "./conversation-binding-KUDxop-C.js";
-import { n as installCodexComputerUse, r as readCodexComputerUseStatus } from "./computer-use-D-0EFJBJ.js";
+import { _ as steerCodexConversationTurn, b as readCodexConversationBindingData, d as parseCodexFastModeArg, f as parseCodexPermissionsModeArg, g as setCodexConversationPermissions, h as setCodexConversationModel, m as setCodexConversationFastMode, o as formatCodexCliSessions, p as readCodexConversationActiveTurn, r as startCodexConversationThread, u as formatPermissionsMode, v as stopCodexConversationTurn, x as resolveCodexDefaultWorkspaceDir, y as createCodexCliNodeConversationBindingData } from "./conversation-binding-DJVOwYW-.js";
+import { n as installCodexComputerUse, r as readCodexComputerUseStatus } from "./computer-use-D0D0M1L7.js";
 import { n as rememberCodexRateLimits } from "./rate-limit-cache-N66I-Rd7.js";
 import { parseStrictPositiveInteger } from "openclaw/plugin-sdk/number-runtime";
 import crypto from "node:crypto";

package/dist/{compact-BXLjhUHX.js → compact-Dgz_jIBU.js}

@@ -1,7 +1,7 @@
 import { d as resolveCodexAppServerRuntimeOptions } from "./config-AlzuNKCY.js";
 import { a as readCodexAppServerBinding } from "./session-binding-BXJAV_xy.js";
 import { n as resolveCodexNativeExecutionBlock } from "./sandbox-guard-DMCJlzmz.js";
-import { t as defaultCodexAppServerClientFactory } from "./client-factory-B8dh39UW.js";
+import { t as defaultCodexAppServerClientFactory } from "./client-factory-DBgo1xC5.js";
 import { embeddedAgentLog } from "openclaw/plugin-sdk/agent-harness-runtime";
 //#region extensions/codex/src/app-server/compact.ts
 const warnedIgnoredCompactionOverrides = /* @__PURE__ */ new Set();

package/dist/{computer-use-D-0EFJBJ.js → computer-use-D0D0M1L7.js}

@@ -1,5 +1,5 @@
 import { d as resolveCodexAppServerRuntimeOptions, f as resolveCodexComputerUseConfig } from "./config-AlzuNKCY.js";
-import { i as describeControlFailure, t as requestCodexAppServerJson } from "./request-DuFgTwRU.js";
+import { i as describeControlFailure, t as requestCodexAppServerJson } from "./request-DKdcodME.js";
 import { existsSync } from "node:fs";
 //#region extensions/codex/src/app-server/computer-use.ts
 var CodexComputerUseSetupError = class extends Error {

package/dist/{conversation-binding-KUDxop-C.js → conversation-binding-DJVOwYW-.js}

@@ -1,10 +1,10 @@
 import { d as resolveCodexAppServerRuntimeOptions, i as codexSandboxPolicyForTurn, m as resolveOpenClawExecPolicyForCodexAppServer, o as isCodexFastServiceTier } from "./config-AlzuNKCY.js";
 import { l as isJsonObject } from "./client-BnOmn0y-.js";
-import { t as CODEX_NATIVE_PERSONALITY_NONE } from "./thread-lifecycle-Bnlv_Q8u.js";
+import { t as CODEX_NATIVE_PERSONALITY_NONE } from "./thread-lifecycle-W15Byt1U.js";
 import { a as readCodexAppServerBinding, i as normalizeCodexAppServerBindingModelProvider, r as isCodexAppServerNativeAuthProfile, s as writeCodexAppServerBinding, t as clearCodexAppServerBinding } from "./session-binding-BXJAV_xy.js";
-import { r as CODEX_CONTROL_METHODS } from "./request-DuFgTwRU.js";
+import { r as CODEX_CONTROL_METHODS } from "./request-DKdcodME.js";
 import { i as readCodexNotificationTurnId, r as readCodexNotificationThreadId, s as formatCodexDisplayText } from "./notification-correlation-BykOI_jh.js";
-import { a as releaseLeasedSharedCodexAppServerClient, f as resolveCodexAppServerAuthProfileIdForAgent, i as getLeasedSharedCodexAppServerClient } from "./shared-client-DBlR-rV2.js";
+import { a as releaseLeasedSharedCodexAppServerClient, f as resolveCodexAppServerAuthProfileIdForAgent, i as getLeasedSharedCodexAppServerClient } from "./shared-client-ByKKWtYX.js";
 import { n as resolveCodexNativeExecutionBlock, r as resolveCodexNativeSandboxBlock } from "./sandbox-guard-DMCJlzmz.js";
 import { resolveTimerTimeoutMs, timestampMsToIsoString } from "openclaw/plugin-sdk/number-runtime";
 import os from "node:os";

package/dist/harness.js

@@ -28,21 +28,21 @@ function createCodexAppServerAgentHarness(options) {
 			};
 		},
 		runAttempt: async (params) => {
-			const { runCodexAppServerAttempt } = await import("./run-attempt-DczP9cMX.js");
+			const { runCodexAppServerAttempt } = await import("./run-attempt-BgaRVuZH.js");
 			return runCodexAppServerAttempt(params, {
 				pluginConfig: options?.resolvePluginConfig?.() ?? options?.pluginConfig,
 				nativeHookRelay: { enabled: true }
 			});
 		},
 		runSideQuestion: async (params) => {
-			const { runCodexAppServerSideQuestion } = await import("./side-question-SjBLGANT.js");
+			const { runCodexAppServerSideQuestion } = await import("./side-question-NLoSbmFG.js");
 			return runCodexAppServerSideQuestion(params, {
 				pluginConfig: options?.resolvePluginConfig?.() ?? options?.pluginConfig,
 				nativeHookRelay: { enabled: true }
 			});
 		},
 		compact: async (params) => {
-			const { maybeCompactCodexAppServerSession } = await import("./compact-BXLjhUHX.js");
+			const { maybeCompactCodexAppServerSession } = await import("./compact-Dgz_jIBU.js");
 			return maybeCompactCodexAppServerSession(params, { pluginConfig: options?.resolvePluginConfig?.() ?? options?.pluginConfig });
 		},
 		reset: async (params) => {
@@ -52,7 +52,7 @@ function createCodexAppServerAgentHarness(options) {
 			}
 		},
 		dispose: async () => {
-			const { clearSharedCodexAppServerClientAndWait } = await import("./shared-client-DBlR-rV2.js").then((n) => n.s);
+			const { clearSharedCodexAppServerClientAndWait } = await import("./shared-client-ByKKWtYX.js").then((n) => n.s);
 			await clearSharedCodexAppServerClientAndWait();
 		}
 	};

package/dist/index.js

@@ -1,12 +1,12 @@
 import { createCodexAppServerAgentHarness } from "./harness.js";
 import { d as resolveCodexAppServerRuntimeOptions, s as isCodexPluginsMarketplaceName, t as CODEX_PLUGINS_MARKETPLACE_NAME, u as readCodexPluginConfig } from "./config-AlzuNKCY.js";
 import { buildCodexProvider } from "./provider.js";
-import { v as ensureCodexPluginActivation, x as defaultCodexAppInventoryCache, y as pluginReadParams } from "./thread-lifecycle-Bnlv_Q8u.js";
+import { v as ensureCodexPluginActivation, x as defaultCodexAppInventoryCache, y as pluginReadParams } from "./thread-lifecycle-W15Byt1U.js";
 import { buildCodexMediaUnderstandingProvider } from "./media-understanding-provider.js";
-import { i as describeControlFailure, n as buildCodexPluginAppCacheKey, t as requestCodexAppServerJson } from "./request-DuFgTwRU.js";
+import { i as describeControlFailure, n as buildCodexPluginAppCacheKey, t as requestCodexAppServerJson } from "./request-DKdcodME.js";
 import { s as formatCodexDisplayText } from "./notification-correlation-BykOI_jh.js";
-import { a as releaseLeasedSharedCodexAppServerClient, f as resolveCodexAppServerAuthProfileIdForAgent, i as getLeasedSharedCodexAppServerClient, n as clearSharedCodexAppServerClientIfCurrentAndWait, p as resolveCodexAppServerFallbackApiKeyCacheKey, u as resolveCodexAppServerAuthAccountCacheKey } from "./shared-client-DBlR-rV2.js";
-import { a as createCodexCliSessionNodeInvokePolicies, c as resolveCodexCliSessionForBindingOnNode, i as createCodexCliSessionNodeHostCommands, l as resumeCodexCliSessionOnNode, n as handleCodexConversationInboundClaim, s as listCodexCliSessionsOnNode, t as handleCodexConversationBindingResolved } from "./conversation-binding-KUDxop-C.js";
+import { a as releaseLeasedSharedCodexAppServerClient, f as resolveCodexAppServerAuthProfileIdForAgent, i as getLeasedSharedCodexAppServerClient, n as clearSharedCodexAppServerClientIfCurrentAndWait, p as resolveCodexAppServerFallbackApiKeyCacheKey, u as resolveCodexAppServerAuthAccountCacheKey } from "./shared-client-ByKKWtYX.js";
+import { a as createCodexCliSessionNodeInvokePolicies, c as resolveCodexCliSessionForBindingOnNode, i as createCodexCliSessionNodeHostCommands, l as resumeCodexCliSessionOnNode, n as handleCodexConversationInboundClaim, s as listCodexCliSessionsOnNode, t as handleCodexConversationBindingResolved } from "./conversation-binding-DJVOwYW-.js";
 import { mutateConfigFile } from "openclaw/plugin-sdk/config-mutation";
 import { resolveLivePluginConfigObject } from "openclaw/plugin-sdk/plugin-config-runtime";
 import { definePluginEntry } from "openclaw/plugin-sdk/plugin-entry";
@@ -48,7 +48,7 @@ async function handleCodexCommand(ctx, options = {}) {
 	}
 }
 async function loadDefaultCodexSubcommandHandler() {
-	const { handleCodexSubcommand } = await import("./command-handlers-B8-28KIp.js");
+	const { handleCodexSubcommand } = await import("./command-handlers-BnVjvHTP.js");
 	return handleCodexSubcommand;
 }
 //#endregion
@@ -1355,7 +1355,9 @@ function isCodexPluginLoadWarningItem(item) {
 	return item.kind === "plugin" && item.action === "install" && item.status === "warning" && item.details?.warningReason === CODEX_PLUGIN_LOAD_WARNING;
 }
 async function sleep(ms) {
-	await new Promise((resolve) => setTimeout(resolve, ms));
+	await new Promise((resolve) => {
+		setTimeout(resolve, ms);
+	});
 }
 async function buildTargetCodexPluginAppCacheKey(ctx) {
 	const targets = resolveCodexMigrationTargets(ctx);

package/dist/media-understanding-provider.js

@@ -1,9 +1,9 @@
 import { CODEX_PROVIDER_ID, FALLBACK_CODEX_MODELS } from "./provider-catalog.js";
 import { d as resolveCodexAppServerRuntimeOptions } from "./config-AlzuNKCY.js";
 import { i as assertCodexTurnStartResponse, l as readCodexTurnCompletedNotification, o as readCodexErrorNotification, r as assertCodexThreadStartResponse } from "./protocol-validators-DIt7cXIp.js";
-import { i as readModelListResult } from "./models-mbjSisZL.js";
+import { i as readModelListResult } from "./models-DEgJXKQy.js";
 import { l as isJsonObject } from "./client-BnOmn0y-.js";
-import { r as buildCodexRuntimeThreadConfig } from "./thread-lifecycle-Bnlv_Q8u.js";
+import { r as buildCodexRuntimeThreadConfig } from "./thread-lifecycle-W15Byt1U.js";
 import { validateJsonSchemaValue } from "openclaw/plugin-sdk/json-schema-runtime";
 import { resolveTimerTimeoutMs } from "openclaw/plugin-sdk/number-runtime";
 //#region extensions/codex/media-understanding-provider.ts
@@ -64,7 +64,7 @@ async function runBoundedCodexVisionTurn(params) {
 	const appServer = resolveCodexAppServerRuntimeOptions({ pluginConfig: params.options.pluginConfig });
 	const timeoutMs = resolveTimerTimeoutMs(params.timeoutMs, 100, 100);
 	const ownsClient = !params.options.clientFactory;
-	const client = params.options.clientFactory ? await params.options.clientFactory(appServer.start, params.profile) : await import("./shared-client-DBlR-rV2.js").then((n) => n.s).then(({ createIsolatedCodexAppServerClient }) => createIsolatedCodexAppServerClient({
+	const client = params.options.clientFactory ? await params.options.clientFactory(appServer.start, params.profile) : await import("./shared-client-ByKKWtYX.js").then((n) => n.s).then(({ createIsolatedCodexAppServerClient }) => createIsolatedCodexAppServerClient({
 		startOptions: appServer.start,
 		timeoutMs,
 		authProfileId: params.profile

package/dist/{models-mbjSisZL.js → models-DEgJXKQy.js}

@@ -40,7 +40,7 @@ async function listAllCodexAppServerModels(options = {}) {
 async function withCodexAppServerModelClient(options, run) {
 	const timeoutMs = options.timeoutMs ?? 2500;
 	const useSharedClient = options.sharedClient !== false;
-	const { createIsolatedCodexAppServerClient, getLeasedSharedCodexAppServerClient, releaseLeasedSharedCodexAppServerClient } = await import("./shared-client-DBlR-rV2.js").then((n) => n.s);
+	const { createIsolatedCodexAppServerClient, getLeasedSharedCodexAppServerClient, releaseLeasedSharedCodexAppServerClient } = await import("./shared-client-ByKKWtYX.js").then((n) => n.s);
 	const client = useSharedClient ? await getLeasedSharedCodexAppServerClient({
 		startOptions: options.startOptions,
 		timeoutMs,

package/dist/{native-hook-relay-DCxPRaBN.js → native-hook-relay-BedqkHpK.js}

@@ -1,5 +1,5 @@
 import { l as isJsonObject } from "./client-BnOmn0y-.js";
-import { S as invalidInlineImageText, w as sanitizeInlineImageDataUrl } from "./thread-lifecycle-Bnlv_Q8u.js";
+import { S as invalidInlineImageText, w as sanitizeInlineImageDataUrl } from "./thread-lifecycle-W15Byt1U.js";
 import { s as formatCodexDisplayText } from "./notification-correlation-BykOI_jh.js";
 import { addTimerTimeoutGraceMs, finiteSecondsToTimerSafeMilliseconds, resolveTimerTimeoutMs } from "openclaw/plugin-sdk/number-runtime";
 import { createHash } from "node:crypto";
@@ -113,10 +113,10 @@ async function waitForPluginApprovalDecision(params) {
 	let onAbort;
 	const abortPromise = new Promise((_, reject) => {
 		if (params.signal.aborted) {
-			reject(params.signal.reason);
+			reject(toLintErrorObject(params.signal.reason, "Non-Error rejection"));
 			return;
 		}
-		onAbort = () => reject(params.signal.reason);
+		onAbort = () => reject(toLintErrorObject(params.signal.reason, "Non-Error rejection"));
 		params.signal.addEventListener("abort", onAbort, { once: true });
 	});
 	try {
@@ -134,6 +134,13 @@ function mapExecDecisionToOutcome(decision) {
 function truncateForGateway(value, maxLength) {
 	return value.length <= maxLength ? value : `${value.slice(0, Math.max(0, maxLength - 3))}...`;
 }
+function toLintErrorObject(value, fallbackMessage) {
+	if (value instanceof Error) return value;
+	if (typeof value === "string") return new Error(value);
+	const error = new Error(fallbackMessage, { cause: value });
+	if (typeof value === "object" && value !== null || typeof value === "function") Object.assign(error, value);
+	return error;
+}
 //#endregion
 //#region extensions/codex/src/app-server/approval-bridge.ts
 const PERMISSION_DESCRIPTION_MAX_LENGTH = 700;
@@ -2098,7 +2105,8 @@ function buildCodexNativeHookRelayConfig(params) {
 	for (const event of CODEX_NATIVE_HOOK_RELAY_EVENTS) {
 		const codexEvent = CODEX_HOOK_EVENT_BY_NATIVE_EVENT[event];
 		const selected = selectedEvents.has(event);
-		if (!selected || !params.relay.shouldRelayEvent(event)) {
+		const shouldRelay = params.relay.shouldRelayEvent(event);
+		if (!selected || !shouldRelay && !(selected && event === "pre_tool_use" && !shouldRelay)) {
 			if (selected || params.clearOmittedEvents) config[`hooks.${codexEvent}`] = [];
 			if (params.clearOmittedEvents) for (const sourcePath of CODEX_SESSION_FLAGS_HOOK_SOURCE_PATHS) hookState[`${sourcePath}:${CODEX_HOOK_KEY_LABEL_BY_NATIVE_EVENT[event]}:0:0`] = { enabled: false };
 			continue;

package/dist/provider.js

@@ -123,7 +123,7 @@ async function listModelsBestEffort(params) {
 	}
 }
 async function listCodexAppServerModelsLazy(options) {
-	const { listCodexAppServerModels } = await import("./models-mbjSisZL.js").then((n) => n.r);
+	const { listCodexAppServerModels } = await import("./models-DEgJXKQy.js").then((n) => n.r);
 	return listCodexAppServerModels(options);
 }
 function normalizeTimeoutMs(value) {

package/dist/{request-DuFgTwRU.js → request-DKdcodME.js}

@@ -1,6 +1,6 @@
 import { n as CodexAppServerRpcError } from "./client-BnOmn0y-.js";
-import { b as buildCodexAppInventoryCacheKey } from "./thread-lifecycle-Bnlv_Q8u.js";
-import { a as releaseLeasedSharedCodexAppServerClient, c as withTimeout, i as getLeasedSharedCodexAppServerClient, m as resolveCodexAppServerHomeDir, r as createIsolatedCodexAppServerClient } from "./shared-client-DBlR-rV2.js";
+import { b as buildCodexAppInventoryCacheKey } from "./thread-lifecycle-W15Byt1U.js";
+import { a as releaseLeasedSharedCodexAppServerClient, c as withTimeout, i as getLeasedSharedCodexAppServerClient, m as resolveCodexAppServerHomeDir, r as createIsolatedCodexAppServerClient } from "./shared-client-ByKKWtYX.js";
 import { t as resolveCodexAppServerDirectSandboxBypassBlock } from "./sandbox-guard-DMCJlzmz.js";
 import { createHash } from "node:crypto";
 //#region extensions/codex/src/app-server/capabilities.ts

package/dist/{run-attempt-DczP9cMX.js → run-attempt-BgaRVuZH.js}

@@ -1,22 +1,22 @@
 import { a as isCodexAppServerApprovalPolicyAllowedByRequirements, c as isCodexSandboxExecServerEnabled, d as resolveCodexAppServerRuntimeOptions, f as resolveCodexComputerUseConfig, g as withMcpElicitationsApprovalPolicy, h as shouldAutoApproveCodexAppServerApprovals, m as resolveOpenClawExecPolicyForCodexAppServer, p as resolveCodexPluginsPolicy, u as readCodexPluginConfig } from "./config-AlzuNKCY.js";
 import { a as readCodexDynamicToolCallParams, c as readCodexTurn, i as assertCodexTurnStartResponse } from "./protocol-validators-DIt7cXIp.js";
 import { a as isCodexAppServerConnectionClosedError, i as isCodexAppServerApprovalRequest, l as isJsonObject, r as compareCodexAppServerVersions, s as MIN_CODEX_SANDBOX_EXEC_SERVER_APP_SERVER_VERSION } from "./client-BnOmn0y-.js";
-import { C as sanitizeCodexHistoryImagePayloads, D as resolveCodexContextEngineProjectionReserveTokens, E as resolveCodexContextEngineProjectionMaxChars, T as projectContextEngineAssemblyForCodex, _ as shouldBuildCodexPluginThreadConfig, a as buildDeveloperInstructions, c as codexDynamicToolsFingerprint, f as startOrResumeThread, g as mergeCodexThreadConfigs, h as buildCodexPluginThreadConfigInputFingerprint, i as buildContextEngineBinding, l as isContextEngineBindingCompatible, m as buildCodexPluginThreadConfig, n as areCodexDynamicToolFingerprintsCompatible, o as buildTurnCollaborationMode, p as isCodexAppServerProfilerEnabled, s as buildTurnStartParams, x as defaultCodexAppInventoryCache } from "./thread-lifecycle-Bnlv_Q8u.js";
+import { C as sanitizeCodexHistoryImagePayloads, D as resolveCodexContextEngineProjectionReserveTokens, E as resolveCodexContextEngineProjectionMaxChars, T as projectContextEngineAssemblyForCodex, _ as shouldBuildCodexPluginThreadConfig, a as buildDeveloperInstructions, c as codexDynamicToolsFingerprint, f as startOrResumeThread, g as mergeCodexThreadConfigs, h as buildCodexPluginThreadConfigInputFingerprint, i as buildContextEngineBinding, l as isContextEngineBindingCompatible, m as buildCodexPluginThreadConfig, n as areCodexDynamicToolFingerprintsCompatible, o as buildTurnCollaborationMode, p as isCodexAppServerProfilerEnabled, s as buildTurnStartParams, x as defaultCodexAppInventoryCache } from "./thread-lifecycle-W15Byt1U.js";
 import { a as readCodexAppServerBinding, n as clearCodexAppServerBindingForThread, s as writeCodexAppServerBinding, t as clearCodexAppServerBinding } from "./session-binding-BXJAV_xy.js";
-import { n as buildCodexPluginAppCacheKey, r as CODEX_CONTROL_METHODS } from "./request-DuFgTwRU.js";
+import { n as buildCodexPluginAppCacheKey, r as CODEX_CONTROL_METHODS } from "./request-DKdcodME.js";
 import { _ as shouldRefreshCodexRateLimitsForUsageLimitMessage, g as resolveCodexUsageLimitResetAtMs, h as formatCodexUsageLimitErrorMessage, i as readCodexNotificationTurnId, n as isCodexNotificationForTurn, r as readCodexNotificationThreadId, s as formatCodexDisplayText, t as describeCodexNotificationCorrelation } from "./notification-correlation-BykOI_jh.js";
-import { a as releaseLeasedSharedCodexAppServerClient, d as resolveCodexAppServerAuthProfileId, f as resolveCodexAppServerAuthProfileIdForAgent, l as refreshCodexAppServerAuthTokens, m as resolveCodexAppServerHomeDir, o as retireSharedCodexAppServerClientIfCurrent, p as resolveCodexAppServerFallbackApiKeyCacheKey, t as clearSharedCodexAppServerClientIfCurrent, u as resolveCodexAppServerAuthAccountCacheKey } from "./shared-client-DBlR-rV2.js";
+import { a as releaseLeasedSharedCodexAppServerClient, d as resolveCodexAppServerAuthProfileId, f as resolveCodexAppServerAuthProfileIdForAgent, l as refreshCodexAppServerAuthTokens, m as resolveCodexAppServerHomeDir, o as retireSharedCodexAppServerClientIfCurrent, p as resolveCodexAppServerFallbackApiKeyCacheKey, t as clearSharedCodexAppServerClientIfCurrent, u as resolveCodexAppServerAuthAccountCacheKey } from "./shared-client-ByKKWtYX.js";
 import { i as resolveCodexNativeExecutionPolicy } from "./sandbox-guard-DMCJlzmz.js";
-import { n as defaultLeasedCodexAppServerClientFactory } from "./client-factory-B8dh39UW.js";
-import { C as resolveCodexTurnAssistantCompletionIdleTimeoutMs, E as withCodexStartupTimeout, S as resolveCodexStartupTimeoutMs, T as resolveCodexTurnTerminalIdleTimeoutMs, _ as normalizeCodexDynamicToolName$1, a as createCodexNativeHookRelay, b as CODEX_POST_REASONING_REPLY_IDLE_TIMEOUT_MS, c as scheduleCodexNativeHookRelayUnregister, d as emitDynamicToolErrorDiagnostic, f as emitDynamicToolStartedDiagnostic, g as isForcedPrivateQaCodexRuntime, h as filterCodexDynamicTools, i as buildCodexNativeHookRelayDisabledConfig, l as handleCodexAppServerElicitationRequest, m as filterToolsForVisionInputs, n as CODEX_NATIVE_HOOK_RELAY_TTL_GRACE_MS, o as resolveCodexNativeHookRelayEvents, p as emitDynamicToolTerminalDiagnostic, r as buildCodexNativeHookRelayConfig, s as resolveCodexNativeHookRelayTtlMs, u as createCodexDynamicToolBridge, v as resolveCodexDynamicToolsLoading, w as resolveCodexTurnCompletionIdleTimeoutMs, x as resolveCodexPostToolRawAssistantCompletionIdleTimeoutMs, y as handleCodexAppServerApprovalRequest } from "./native-hook-relay-DCxPRaBN.js";
-import { t as ensureCodexComputerUse } from "./computer-use-D-0EFJBJ.js";
+import { n as defaultLeasedCodexAppServerClientFactory } from "./client-factory-DBgo1xC5.js";
+import { C as resolveCodexTurnAssistantCompletionIdleTimeoutMs, E as withCodexStartupTimeout, S as resolveCodexStartupTimeoutMs, T as resolveCodexTurnTerminalIdleTimeoutMs, _ as normalizeCodexDynamicToolName$1, a as createCodexNativeHookRelay, b as CODEX_POST_REASONING_REPLY_IDLE_TIMEOUT_MS, c as scheduleCodexNativeHookRelayUnregister, d as emitDynamicToolErrorDiagnostic, f as emitDynamicToolStartedDiagnostic, g as isForcedPrivateQaCodexRuntime, h as filterCodexDynamicTools, i as buildCodexNativeHookRelayDisabledConfig, l as handleCodexAppServerElicitationRequest, m as filterToolsForVisionInputs, n as CODEX_NATIVE_HOOK_RELAY_TTL_GRACE_MS, o as resolveCodexNativeHookRelayEvents, p as emitDynamicToolTerminalDiagnostic, r as buildCodexNativeHookRelayConfig, s as resolveCodexNativeHookRelayTtlMs, u as createCodexDynamicToolBridge, v as resolveCodexDynamicToolsLoading, w as resolveCodexTurnCompletionIdleTimeoutMs, x as resolveCodexPostToolRawAssistantCompletionIdleTimeoutMs, y as handleCodexAppServerApprovalRequest } from "./native-hook-relay-BedqkHpK.js";
+import { t as ensureCodexComputerUse } from "./computer-use-D0D0M1L7.js";
 import { n as rememberCodexRateLimits, t as readRecentCodexRateLimits } from "./rate-limit-cache-N66I-Rd7.js";
 import { asDateTimestampMs, parseStrictNonNegativeInteger, resolveTimerTimeoutMs } from "openclaw/plugin-sdk/number-runtime";
 import { createHash, randomUUID } from "node:crypto";
 import fsSync from "node:fs";
 import { loadExecApprovals } from "openclaw/plugin-sdk/exec-approvals-runtime";
 import { asBoolean, asFiniteNumber, normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
-import { CODEX_APP_SERVER_CONTEXT_ENGINE_HOST, TOOL_PROGRESS_OUTPUT_MAX_CHARS, acquireSessionWriteLock, appendSessionTranscriptMessage, assembleHarnessContextEngine, assertContextEngineHostSupport, awaitAgentHarnessAgentEndHook, bootstrapHarnessContextEngine, buildAgentHookContextChannelFields, buildBootstrapContextForFiles, buildEmbeddedAttemptToolRunContext, buildHarnessContextEngineRuntimeContext, buildHarnessContextEngineRuntimeContextFromUsage, classifyAgentHarnessTerminalOutcome, clearActiveEmbeddedRun, embeddedAgentLog, emitAgentEvent, emitSessionTranscriptUpdate, finalizeHarnessContextEngineTurn, formatErrorMessage, formatToolAggregate, formatToolProgressOutput, getAgentHarnessHookRunner, getBeforeToolCallPolicyDiagnosticState, inferToolMetaFromArgs, isActiveHarnessContextEngine, isSubagentSessionKey, loadCodexBundleMcpThreadConfig, normalizeAgentRuntimeTools, normalizeUsage, resolveAgentHarnessBeforePromptBuildResult, resolveAttemptSpawnWorkspaceDir, resolveBootstrapFilesForRun, resolveContextEngineOwnerPluginId, resolveModelAuthMode, resolveSandboxContext, resolveSessionAgentIds, resolveSessionWriteLockOptions, resolveUserPath, runAgentCleanupStep, runAgentHarnessAfterCompactionHook, runAgentHarnessAfterToolCallHook, runAgentHarnessAgentEndHook, runAgentHarnessBeforeCompactionHook, runAgentHarnessBeforeMessageWriteHook, runAgentHarnessLlmInputHook, runAgentHarnessLlmOutputHook, runHarnessContextEngineMaintenance, setActiveEmbeddedRun, supportsModelTools } from "openclaw/plugin-sdk/agent-harness-runtime";
+import { CODEX_APP_SERVER_CONTEXT_ENGINE_HOST, TOOL_PROGRESS_OUTPUT_MAX_CHARS, acquireSessionWriteLock, appendSessionTranscriptMessage, assembleHarnessContextEngine, assertContextEngineHostSupport, awaitAgentHarnessAgentEndHook, bootstrapHarnessContextEngine, buildAgentHookContextChannelFields, buildBootstrapContextForFiles, buildEmbeddedAttemptToolRunContext, buildHarnessContextEngineRuntimeContext, buildHarnessContextEngineRuntimeContextFromUsage, classifyAgentHarnessTerminalOutcome, clearActiveEmbeddedRun, embeddedAgentLog, emitAgentEvent, emitSessionTranscriptUpdate, filterProviderNormalizableTools, finalizeHarnessContextEngineTurn, formatErrorMessage, formatToolAggregate, formatToolProgressOutput, getAgentHarnessHookRunner, getBeforeToolCallPolicyDiagnosticState, inferToolMetaFromArgs, isActiveHarnessContextEngine, isSubagentSessionKey, loadCodexBundleMcpThreadConfig, normalizeAgentRuntimeTools, normalizeUsage, resolveAgentHarnessBeforePromptBuildResult, resolveAttemptSpawnWorkspaceDir, resolveBootstrapFilesForRun, resolveContextEngineOwnerPluginId, resolveModelAuthMode, resolveSandboxContext, resolveSessionAgentIds, resolveSessionWriteLockOptions, resolveUserPath, runAgentCleanupStep, runAgentHarnessAfterCompactionHook, runAgentHarnessAfterToolCallHook, runAgentHarnessAgentEndHook, runAgentHarnessBeforeCompactionHook, runAgentHarnessBeforeMessageWriteHook, runAgentHarnessLlmInputHook, runAgentHarnessLlmOutputHook, runHarnessContextEngineMaintenance, setActiveEmbeddedRun, supportsModelTools } from "openclaw/plugin-sdk/agent-harness-runtime";
 import { spawn } from "node:child_process";
 import { once } from "node:events";
 import { WebSocketServer } from "ws";
@@ -1266,7 +1266,11 @@ async function buildDynamicTools(input) {
 		}
 	});
 	toolBuildStages.mark("create-openclaw-coding-tools");
-	const codexFilteredTools = addNodeShellDynamicToolsIfNeeded(addSandboxShellDynamicToolsIfAvailable(isCodexMemoryFlushRun(params) ? filterCodexMemoryFlushDynamicTools(allTools) : filterCodexDynamicTools(allTools, input.pluginConfig), allTools, input), allTools, input);
+	const preNormalizationDiagnostics = [];
+	const readableAllToolProjection = filterProviderNormalizableTools(allTools);
+	preNormalizationDiagnostics.push(...readableAllToolProjection.diagnostics);
+	const readableAllTools = [...readableAllToolProjection.tools];
+	const codexFilteredTools = addNodeShellDynamicToolsIfNeeded(addSandboxShellDynamicToolsIfAvailable(isCodexMemoryFlushRun(params) ? filterCodexMemoryFlushDynamicTools(readableAllTools) : filterCodexDynamicTools(readableAllTools, input.pluginConfig), readableAllTools, input), readableAllTools, input);
 	toolBuildStages.mark("codex-filtering");
 	const visionFilteredTools = filterToolsForVisionInputs(codexFilteredTools, {
 		modelHasVision,
@@ -1284,9 +1288,20 @@ async function buildDynamicTools(input) {
 		env: process.env,
 		modelId: params.modelId,
 		modelApi: params.model.api,
-		model: params.model
+		model: params.model,
+		onPreNormalizationSchemaDiagnostics: (diagnostics) => preNormalizationDiagnostics.push(...diagnostics)
 	});
 	toolBuildStages.mark("runtime-normalization");
+	if (preNormalizationDiagnostics.length > 0) embeddedAgentLog.warn(`codex app-server quarantined ${preNormalizationDiagnostics.length} unsupported runtime tool schema${preNormalizationDiagnostics.length === 1 ? "" : "s"} before dynamic tool registration`, {
+		runId: params.runId,
+		sessionId: params.sessionId,
+		diagnostics: preNormalizationDiagnostics.map((diagnostic) => ({
+			index: diagnostic.toolIndex,
+			tool: diagnostic.toolName,
+			violations: diagnostic.violations.slice(0, 12),
+			violationCount: diagnostic.violations.length
+		}))
+	});
 	const summary = toolBuildStages.snapshot();
 	if (shouldWarnCodexDynamicToolBuildStageSummary(summary)) {
 		const phase = input.forceHeartbeatTool ? "registered-tools" : "runtime-tools";
@@ -1296,7 +1311,7 @@ async function buildDynamicTools(input) {
 			phase,
 			totalMs: summary.totalMs,
 			stages: summary.stages,
-			allToolCount: allTools.length,
+			allToolCount: readableAllTools.length,
 			codexFilteredToolCount: codexFilteredTools.length,
 			visionFilteredToolCount: visionFilteredTools.length,
 			filteredToolCount: filteredTools.length,
@@ -2767,6 +2782,7 @@ async function startCodexAttemptThread(params) {
 							mcpServersFingerprintEvaluated: params.bundleMcpThreadConfig.evaluated,
 							environmentSelection: startupEnvironmentSelection,
 							contextEngineProjection: params.contextEngineProjection,
+							signal: params.signal,
 							pluginThreadConfig: pluginThreadConfigRequired ? {
 								enabled: true,
 								inputFingerprint: pluginThreadConfigInputFingerprint,
@@ -2819,7 +2835,6 @@ async function startCodexAttemptThread(params) {
 					const failedClient = attemptedClient;
 					const clearedSharedClient = clearSharedCodexAppServerClientIfCurrent(failedClient);
 					if (startupClientForAbandonedRequestCleanup === failedClient) startupClientForAbandonedRequestCleanup = void 0;
-					attemptedClient = void 0;
 					if (attempt >= CODEX_APP_SERVER_STARTUP_CONNECTION_CLOSE_MAX_ATTEMPTS) {
 						embeddedAgentLog.warn("codex app-server connection closed during startup; retries exhausted", {
 							attempt,
@@ -5474,6 +5489,7 @@ var CodexNativeSubagentTaskMirror = class {
 		this.params = params;
 		this.runtime = runtime;
 		this.mirroredThreadIds = /* @__PURE__ */ new Set();
+		this.failedMirrorThreadIds = /* @__PURE__ */ new Set();
 		this.terminalRunIds = /* @__PURE__ */ new Set();
 		this.now = params.now ?? Date.now;
 	}
@@ -5503,7 +5519,7 @@ var CodexNativeSubagentTaskMirror = class {
 		const label = trimOptional(spawn.agent_nickname) ?? trimOptional(thread.agentNickname) ?? trimOptional(spawn.agent_role) ?? trimOptional(thread.agentRole) ?? "Codex subagent";
 		const task = trimOptional(thread.preview) ?? `Codex native subagent${label === "Codex subagent" ? "" : ` ${label}`}`;
 		const createdAt = secondsToMillis$1(thread.createdAt) ?? this.now();
-		this.runtime.createRunningTaskRun({
+		if (!this.runtime.tryCreateRunningTaskRun({
 			sourceId: runId,
 			agentId: this.params.agentId,
 			runId,
@@ -5515,7 +5531,13 @@ var CodexNativeSubagentTaskMirror = class {
 			startedAt: createdAt,
 			lastEventAt: this.now(),
 			progressSummary: "Codex native subagent started."
-		});
+		})) {
+			this.mirroredThreadIds.delete(threadId);
+			this.failedMirrorThreadIds.add(threadId);
+			return;
+		}
+		this.failedMirrorThreadIds.delete(threadId);
+		this.terminalRunIds.delete(runId);
 		this.applyStatus(threadId, thread.status);
 	}
 	handleThreadStatusChanged(params) {
@@ -5524,6 +5546,7 @@ var CodexNativeSubagentTaskMirror = class {
 		this.applyStatus(notification.threadId, notification.status);
 	}
 	applyStatus(threadId, status) {
+		if (!this.mirroredThreadIds.has(threadId) && this.failedMirrorThreadIds.has(threadId)) return;
 		const statusType = status?.type;
 		if (!statusType) return;
 		const runId = codexNativeSubagentRunId(threadId);
@@ -5603,7 +5626,7 @@ var CodexNativeSubagentTaskMirror = class {
 		const prompt = trimOptional(readString$3(item, "prompt"));
 		const runId = codexNativeSubagentRunId(normalizedThreadId);
 		const createdAt = this.now();
-		this.runtime.createRunningTaskRun({
+		if (!this.runtime.tryCreateRunningTaskRun({
 			sourceId: runId,
 			agentId: this.params.agentId,
 			runId,
@@ -5615,9 +5638,16 @@ var CodexNativeSubagentTaskMirror = class {
 			startedAt: createdAt,
 			lastEventAt: createdAt,
 			progressSummary: "Codex native subagent spawned."
-		});
+		})) {
+			this.mirroredThreadIds.delete(normalizedThreadId);
+			this.failedMirrorThreadIds.add(normalizedThreadId);
+			return;
+		}
+		this.failedMirrorThreadIds.delete(normalizedThreadId);
+		this.terminalRunIds.delete(runId);
 	}
 	applyCollabAgentStatus(threadId, status, message) {
+		if (!this.mirroredThreadIds.has(threadId) && this.failedMirrorThreadIds.has(threadId)) return;
 		const normalizedStatus = normalizeAgentStateStatus(status);
 		if (!normalizedStatus) return;
 		const runId = codexNativeSubagentRunId(threadId);
@@ -7301,17 +7331,21 @@ async function runCodexAppServerAttempt(params, options = {}) {
 	else params.abortSignal?.addEventListener("abort", abortFromUpstream, { once: true });
 	const agentDir = params.agentDir ?? resolveAgentDir$1(params.config ?? {}, sessionAgentId);
 	preDynamicStartupStages.mark("session-agent");
+	const activeContextEngine = isActiveHarnessContextEngine(params.contextEngine) ? params.contextEngine : void 0;
+	const isInactiveThreadBootstrapBinding = (binding) => !activeContextEngine && binding?.contextEngine?.projection?.mode === "thread_bootstrap";
 	let startupBinding = await readCodexAppServerBinding(params.sessionFile);
 	preDynamicStartupStages.mark("read-binding");
 	const startupBindingAuthProfileId = startupBinding?.authProfileId;
+	const initialStartupBindingHadInactiveThreadBootstrap = isInactiveThreadBootstrapBinding(startupBinding);
 	startupBinding = await rotateOversizedCodexAppServerStartupBinding({
 		binding: startupBinding,
 		sessionFile: params.sessionFile,
 		agentDir,
 		codexHome: appServer.start.env?.CODEX_HOME,
 		config: params.config,
-		contextEngineActive: isActiveHarnessContextEngine(params.contextEngine)
+		contextEngineActive: Boolean(activeContextEngine)
 	});
+	const initialInactiveThreadBootstrapBindingForcedFreshStart = initialStartupBindingHadInactiveThreadBootstrap && !startupBinding?.threadId;
 	preDynamicStartupStages.mark("rotate-binding");
 	const startupAuthProfileCandidate = params.runtimePlan?.auth.forwardedAuthProfileId ?? params.authProfileId ?? startupBinding?.authProfileId ?? startupBindingAuthProfileId;
 	const startupAuthProfileId = params.authProfileStore ? resolveCodexAppServerAuthProfileId({
@@ -7366,7 +7400,6 @@ async function runCodexAppServerAttempt(params, options = {}) {
 	});
 	preDynamicStartupStages.mark("native-tool-surface");
 	for (const diagnostic of bundleMcpThreadConfig.diagnostics) embeddedAgentLog.warn(`bundle-mcp: ${diagnostic.pluginId}: ${diagnostic.message}`);
-	const activeContextEngine = isActiveHarnessContextEngine(params.contextEngine) ? params.contextEngine : void 0;
 	if (activeContextEngine) assertContextEngineHostSupport({
 		contextEngine: activeContextEngine,
 		operation: "agent-run",
@@ -7502,6 +7535,7 @@ async function runCodexAppServerAttempt(params, options = {}) {
 	let contextEngineProjection;
 	let precomputedStaleBindingContinuityProjectionApplied = false;
 	let staleBindingContinuityForcedFreshStart = false;
+	let inactiveThreadBootstrapBindingForcedFreshStart = initialInactiveThreadBootstrapBindingForcedFreshStart;
 	const applyFreshThreadContinuityProjection = () => {
 		const projection = projectContextEngineAssemblyForCodex({
 			assembledMessages: historyMessages,
@@ -7632,6 +7666,10 @@ async function runCodexAppServerAttempt(params, options = {}) {
 		precomputedStaleBindingContinuityProjectionApplied = false;
 		staleBindingContinuityForcedFreshStart = false;
 		if (activeContextEngine || !binding?.threadId) return false;
+		if (isInactiveThreadBootstrapBinding(binding)) {
+			inactiveThreadBootstrapBindingForcedFreshStart = true;
+			return false;
+		}
 		const projected = applyResumeStaleBindingContinuityProjection(binding);
 		precomputedStaleBindingContinuityProjectionApplied = projected;
 		return projected;
@@ -7640,6 +7678,7 @@ async function runCodexAppServerAttempt(params, options = {}) {
 		if (activeContextEngine || !historyMessages.some((message) => message.role === "user")) return false;
 		if (action === "resumed" && precomputedStaleBindingContinuityProjectionApplied) return true;
 		if (action === "started" && staleBindingContinuityForcedFreshStart) return true;
+		if (action === "started" && inactiveThreadBootstrapBindingForcedFreshStart) return false;
 		if (action === "resumed" && binding) return applyResumeStaleBindingContinuityProjection(binding);
 		if (action === "started") {
 			applyFreshThreadContinuityProjection();
@@ -7651,6 +7690,7 @@ async function runCodexAppServerAttempt(params, options = {}) {
 	const rotateStartupBindingForProjectedTurn = async () => {
 		if (!startupBinding?.threadId) return;
 		const previousThreadId = startupBinding.threadId;
+		const hadInactiveThreadBootstrapBinding = isInactiveThreadBootstrapBinding(startupBinding);
 		const projectedTurnTokens = estimateCodexAppServerProjectedTurnTokens({
 			prompt: codexTurnPromptText,
 			developerInstructions: buildRenderedCodexDeveloperInstructions()
@@ -7665,7 +7705,8 @@ async function runCodexAppServerAttempt(params, options = {}) {
 			projectedTurnTokens
 		});
 		if (startupBinding?.threadId) return;
-		staleBindingContinuityForcedFreshStart = precomputedStaleBindingContinuityProjectionApplied;
+		inactiveThreadBootstrapBindingForcedFreshStart = hadInactiveThreadBootstrapBinding;
+		staleBindingContinuityForcedFreshStart = precomputedStaleBindingContinuityProjectionApplied && !inactiveThreadBootstrapBindingForcedFreshStart;
 		if (activeContextEngine) {
 			contextEngineProjection = void 0;
 			try {
@@ -7703,8 +7744,17 @@ async function runCodexAppServerAttempt(params, options = {}) {
 	let client;
 	let thread;
 	let trajectoryEndRecorded = false;
+	const markTrajectoryEndRecorded = () => {
+		trajectoryEndRecorded = true;
+	};
 	let nativeHookRelay;
 	let releaseSharedClientLease;
+	const releaseSharedClientLeaseOnce = () => {
+		const release = releaseSharedClientLease;
+		if (!release) return;
+		releaseSharedClientLease = void 0;
+		release();
+	};
 	let sandboxExecEnvironmentAcquired = false;
 	const releaseSandboxExecEnvironment = async () => {
 		if (sandboxExecEnvironmentAcquired) {
@@ -8365,6 +8415,14 @@ async function runCodexAppServerAttempt(params, options = {}) {
 		}
 	});
 	let turn;
+	const throwIfTurnStartAcceptedAfterAbort = () => {
+		if (!runAbortController.signal.aborted) return;
+		const reason = runAbortController.signal.reason;
+		if (reason instanceof Error) throw reason;
+		const error = new Error(typeof reason === "string" && reason.length > 0 ? reason : "codex app-server turn start aborted before acceptance");
+		error.name = "AbortError";
+		throw error;
+	};
 	const startCodexTurn = async () => {
 		const turnStartParams = buildTurnStartParams(params, {
 			threadId: thread.threadId,
@@ -8379,10 +8437,12 @@ async function runCodexAppServerAttempt(params, options = {}) {
 			heartbeatCollaborationInstructions: workspaceBootstrapContext.heartbeatCollaborationInstructions
 		});
 		codexModelCallDiagnostics.setRequestPayloadBytes(utf8JsonByteLength(turnStartParams));
-		return assertCodexTurnStartResponse(await client.request("turn/start", turnStartParams, {
+		const startedTurn = assertCodexTurnStartResponse(await client.request("turn/start", turnStartParams, {
 			timeoutMs: params.timeoutMs,
 			signal: runAbortController.signal
 		}));
+		throwIfTurnStartAcceptedAfterAbort();
+		return startedTurn;
 	};
 	try {
 		codexModelCallDiagnostics.emitStarted();
@@ -8465,7 +8525,7 @@ async function runCodexAppServerAttempt(params, options = {}) {
 				aborted: runAbortController.signal.aborted,
 				promptError: turnStartErrorMessage
 			});
-			trajectoryEndRecorded = true;
+			markTrajectoryEndRecorded();
 			runAgentHarnessLlmOutputHook({
 				event: {
 					runId: params.runId,
@@ -8522,8 +8582,7 @@ async function runCodexAppServerAttempt(params, options = {}) {
 				}
 			});
 			params.abortSignal?.removeEventListener("abort", abortFromUpstream);
-			releaseSharedClientLease?.();
-			releaseSharedClientLease = void 0;
+			releaseSharedClientLeaseOnce();
 			if (usageLimitError) {
 				await markCodexAuthProfileBlockedFromRateLimits({
 					params,
@@ -8541,8 +8600,7 @@ async function runCodexAppServerAttempt(params, options = {}) {
 		}
 	}
 	if (!turn) {
-		releaseSharedClientLease?.();
-		releaseSharedClientLease = void 0;
+		releaseSharedClientLeaseOnce();
 		throw new Error("codex app-server turn/start failed without an error");
 	}
 	turnIdRef.current = turn.turn.id;
@@ -8609,7 +8667,7 @@ async function runCodexAppServerAttempt(params, options = {}) {
 	const handle = {
 		kind: "embedded",
 		queueMessage: async (text, optionsLocal) => activeSteeringQueue.queue(text, optionsLocal),
-		isStreaming: () => !completed,
+		isStreaming: () => !completed && !runAbortController.signal.aborted,
 		isCompacting: () => projectorRef.current?.isCompacting() ?? false,
 		sourceReplyDeliveryMode: params.sourceReplyDeliveryMode,
 		cancel: () => runAbortController.abort("cancelled"),
@@ -8717,7 +8775,7 @@ async function runCodexAppServerAttempt(params, options = {}) {
 			yieldDetected,
 			promptError: normalizeCodexTrajectoryError(finalPromptError)
 		});
-		trajectoryEndRecorded = true;
+		markTrajectoryEndRecorded();
 		await mirrorTranscriptBestEffort({
 			params,
 			agentId: sessionAgentId,
@@ -8855,7 +8913,7 @@ async function runCodexAppServerAttempt(params, options = {}) {
 		notificationCleanup();
 		requestCleanup();
 		closeCleanup?.();
-		releaseSharedClientLease?.();
+		releaseSharedClientLeaseOnce();
 		if (nativeHookRelay) if (shouldDelayNativeHookRelayUnregister) scheduleCodexNativeHookRelayUnregister({
 			relay: nativeHookRelay,
 			hookTimeoutSec: options.nativeHookRelay?.hookTimeoutSec

package/dist/{shared-client-DBlR-rV2.js → shared-client-ByKKWtYX.js}

@@ -12,6 +12,8 @@ import { fileURLToPath } from "node:url";
 import { withTimeout } from "openclaw/plugin-sdk/security-runtime";
 //#region extensions/codex/src/app-server/auth-bridge.ts
 const CODEX_APP_SERVER_AUTH_PROVIDER = "openai";
+const LEGACY_CODEX_APP_SERVER_AUTH_PROVIDER = "codex-cli";
+const CODEX_APP_SERVER_EXTERNAL_CLI_PROVIDER_IDS = [CODEX_APP_SERVER_AUTH_PROVIDER, LEGACY_CODEX_APP_SERVER_AUTH_PROVIDER];
 const OPENAI_PROVIDER = "openai";
 const OPENAI_CODEX_DEFAULT_PROFILE_ID = "openai:default";
 const CODEX_HOME_ENV_VAR = "CODEX_HOME";
@@ -65,7 +67,7 @@ function ensureCodexAppServerAuthProfileStore(params) {
 	return ensureAuthProfileStore(params.agentDir, {
 		allowKeychainPrompt: false,
 		config: params.config,
-		externalCliProviderIds: [CODEX_APP_SERVER_AUTH_PROVIDER],
+		externalCliProviderIds: CODEX_APP_SERVER_EXTERNAL_CLI_PROVIDER_IDS,
 		...params.authProfileId ? { externalCliProfileIds: [params.authProfileId] } : {}
 	});
 }
@@ -365,7 +367,8 @@ async function resolveOAuthCredentialForCodexAppServer(profileId, credential, pa
 	} : candidate;
 }
 function isCodexAppServerAuthProvider(provider, config) {
-	return resolveProviderIdForAuth(provider, { config }) === CODEX_APP_SERVER_AUTH_PROVIDER;
+	const resolvedProvider = resolveProviderIdForAuth(provider, { config });
+	return resolvedProvider === CODEX_APP_SERVER_AUTH_PROVIDER || resolvedProvider === LEGACY_CODEX_APP_SERVER_AUTH_PROVIDER;
 }
 function isOpenAIApiKeyBackupCredential(credential, config) {
 	return credential.type === "api_key" && resolveProviderIdForAuth(credential.provider, { config }) === OPENAI_PROVIDER;

package/dist/{side-question-SjBLGANT.js → side-question-NLoSbmFG.js}

@@ -1,12 +1,12 @@
 import { d as resolveCodexAppServerRuntimeOptions, h as shouldAutoApproveCodexAppServerApprovals, u as readCodexPluginConfig } from "./config-AlzuNKCY.js";
 import { a as readCodexDynamicToolCallParams, c as readCodexTurn, i as assertCodexTurnStartResponse, t as assertCodexThreadForkResponse } from "./protocol-validators-DIt7cXIp.js";
 import { i as isCodexAppServerApprovalRequest, l as isJsonObject } from "./client-BnOmn0y-.js";
-import { d as resolveReasoningEffort, g as mergeCodexThreadConfigs, r as buildCodexRuntimeThreadConfig, t as CODEX_NATIVE_PERSONALITY_NONE, u as resolveCodexAppServerModelProvider } from "./thread-lifecycle-Bnlv_Q8u.js";
+import { d as resolveReasoningEffort, g as mergeCodexThreadConfigs, r as buildCodexRuntimeThreadConfig, t as CODEX_NATIVE_PERSONALITY_NONE, u as resolveCodexAppServerModelProvider } from "./thread-lifecycle-W15Byt1U.js";
 import { a as readCodexAppServerBinding } from "./session-binding-BXJAV_xy.js";
 import { h as formatCodexUsageLimitErrorMessage, i as readCodexNotificationTurnId, r as readCodexNotificationThreadId } from "./notification-correlation-BykOI_jh.js";
-import { a as releaseLeasedSharedCodexAppServerClient, i as getLeasedSharedCodexAppServerClient, l as refreshCodexAppServerAuthTokens } from "./shared-client-DBlR-rV2.js";
+import { a as releaseLeasedSharedCodexAppServerClient, i as getLeasedSharedCodexAppServerClient, l as refreshCodexAppServerAuthTokens } from "./shared-client-ByKKWtYX.js";
 import { n as resolveCodexNativeExecutionBlock } from "./sandbox-guard-DMCJlzmz.js";
-import { d as emitDynamicToolErrorDiagnostic, f as emitDynamicToolStartedDiagnostic, h as filterCodexDynamicTools, i as buildCodexNativeHookRelayDisabledConfig, l as handleCodexAppServerElicitationRequest, m as filterToolsForVisionInputs, p as emitDynamicToolTerminalDiagnostic, r as buildCodexNativeHookRelayConfig, t as CODEX_NATIVE_HOOK_RELAY_EVENTS, u as createCodexDynamicToolBridge, v as resolveCodexDynamicToolsLoading, y as handleCodexAppServerApprovalRequest } from "./native-hook-relay-DCxPRaBN.js";
+import { d as emitDynamicToolErrorDiagnostic, f as emitDynamicToolStartedDiagnostic, h as filterCodexDynamicTools, i as buildCodexNativeHookRelayDisabledConfig, l as handleCodexAppServerElicitationRequest, m as filterToolsForVisionInputs, p as emitDynamicToolTerminalDiagnostic, r as buildCodexNativeHookRelayConfig, t as CODEX_NATIVE_HOOK_RELAY_EVENTS, u as createCodexDynamicToolBridge, v as resolveCodexDynamicToolsLoading, y as handleCodexAppServerApprovalRequest } from "./native-hook-relay-BedqkHpK.js";
 import { n as rememberCodexRateLimits, t as readRecentCodexRateLimits } from "./rate-limit-cache-N66I-Rd7.js";
 import { buildAgentHookContextChannelFields, embeddedAgentLog, formatErrorMessage, registerNativeHookRelay, resolveAgentDir, resolveAttemptSpawnWorkspaceDir, resolveModelAuthMode, resolveSandboxContext, resolveSessionAgentIds, supportsModelTools } from "openclaw/plugin-sdk/agent-harness-runtime";
 //#region extensions/codex/src/app-server/side-question.ts

package/dist/{thread-lifecycle-Bnlv_Q8u.js → thread-lifecycle-W15Byt1U.js}

@@ -1115,6 +1115,14 @@ async function startOrResumeThread(params) {
 	let preserveExistingBinding = false;
 	let rotatedContextEngineBinding = false;
 	let prebuiltPluginThreadConfig;
+	const throwIfAborted = () => {
+		if (!params.signal?.aborted) return;
+		const reason = params.signal.reason;
+		if (reason instanceof Error) throw reason;
+		const error = new Error(typeof reason === "string" && reason.length > 0 ? reason : "codex app-server thread lifecycle aborted");
+		error.name = "AbortError";
+		throw error;
+	};
 	if (binding?.threadId && params.nativeCodeModeEnabled === false) {
 		embeddedAgentLog.debug("codex app-server native tool surface disabled for turn; starting transient thread", { threadId: binding.threadId });
 		preserveExistingBinding = true;
@@ -1214,7 +1222,8 @@ async function startOrResumeThread(params) {
 			nativeCodeModeEnabled: params.nativeCodeModeEnabled,
 			nativeCodeModeOnlyEnabled: params.nativeCodeModeOnlyEnabled
 		}));
-		const response = assertCodexThreadResumeResponse(await lifecycleTiming.measure("thread_resume_request", () => params.client.request("thread/resume", resumeParams)));
+		const response = assertCodexThreadResumeResponse(await lifecycleTiming.measure("thread_resume_request", () => params.client.request("thread/resume", resumeParams, { signal: params.signal })));
+		throwIfAborted();
 		const boundAuthProfileId = authProfileId;
 		const fallbackModelProvider = resolveCodexAppServerModelProvider({
 			provider: params.params.provider,
@@ -1302,12 +1311,13 @@ async function startOrResumeThread(params) {
 	}));
 	const response = assertCodexThreadStartResponse(await lifecycleTiming.measure("thread_start_request", async () => {
 		try {
-			return await params.client.request("thread/start", startParams);
+			return await params.client.request("thread/start", startParams, { signal: params.signal });
 		} catch (error) {
 			if (error instanceof CodexAppServerRpcError) throw new CodexThreadStartRequestError(error);
 			throw error;
 		}
 	}));
+	throwIfAborted();
 	const modelProvider = resolveCodexAppServerModelProvider({
 		provider: params.params.provider,
 		authProfileId: params.params.authProfileId,

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "@openclaw/codex",
-  "version": "2026.5.31-beta.3",
+  "version": "2026.6.1-beta.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@openclaw/codex",
-      "version": "2026.5.31-beta.3",
+      "version": "2026.6.1-beta.1",
       "dependencies": {
         "@openai/codex": "0.135.0",
         "typebox": "1.1.39",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openclaw/codex",
-  "version": "2026.5.31-beta.3",
+  "version": "2026.6.1-beta.1",
   "description": "OpenClaw Codex app-server harness and model provider plugin with a Codex-managed GPT catalog.",
   "repository": {
     "type": "git",
@@ -26,10 +26,10 @@
       "minHostVersion": ">=2026.5.1-beta.1"
     },
     "compat": {
-      "pluginApi": ">=2026.5.31-beta.3"
+      "pluginApi": ">=2026.6.1-beta.1"
     },
     "build": {
-      "openclawVersion": "2026.5.31-beta.3"
+      "openclawVersion": "2026.6.1-beta.1"
     },
     "release": {
       "publishToClawHub": true,
@@ -47,7 +47,7 @@
     "README.md"
   ],
   "peerDependencies": {
-    "openclaw": ">=2026.5.31-beta.3"
+    "openclaw": ">=2026.6.1-beta.1"
   },
   "peerDependenciesMeta": {
     "openclaw": {