@openclaw/codex 2026.6.9-beta.1 → 2026.6.10-beta.1

package/dist/{app-server-policy-KpyUye2D.js → app-server-policy-BPTiVNsW.js}

@@ -1,6 +1,6 @@
 import { n as isJsonObject } from "./protocol-dh-ETiNd.js";
-import { n as canUseCodexModelBackedApprovalsReviewerForModel } from "./config-BksX0T33.js";
-import { a as hasCodexRateLimitSnapshots, c as summarizeCodexAccountRateLimits, u as summarizeCodexRateLimits } from "./provider-qJygHQx4.js";
+import { n as canUseCodexModelBackedApprovalsReviewerForModel } from "./config-CszD0vP3.js";
+import { a as hasCodexRateLimitSnapshots, c as summarizeCodexAccountRateLimits, u as summarizeCodexRateLimits } from "./provider-B-OHpbD3.js";
 //#region extensions/codex/src/command-formatters.ts
 /** Formats the combined `/codex status` probe result. */
 function formatCodexStatus(probes) {

package/dist/{attempt-notifications-Meja3TX6.js → attempt-notifications-C3zROmkk.js}

@@ -1,5 +1,5 @@
 import { n as isJsonObject } from "./protocol-dh-ETiNd.js";
-import { z as isCodexNotificationForTurn } from "./thread-lifecycle-CbJqqnEw.js";
+import { B as isCodexNotificationForTurn } from "./thread-lifecycle-CJdHuthD.js";
 import { asBoolean } from "openclaw/plugin-sdk/string-coerce-runtime";
 //#region extensions/codex/src/app-server/attempt-notifications.ts
 /**

package/dist/{client-m7XiCQpO.js → client-CLrtWgrD.js}

@@ -1,5 +1,5 @@
 import { r as isRpcResponse } from "./protocol-dh-ETiNd.js";
-import { d as resolveCodexAppServerRuntimeOptions } from "./config-BksX0T33.js";
+import { d as resolveCodexAppServerRuntimeOptions } from "./config-CszD0vP3.js";
 import { materializeWindowsSpawnProgram, resolveWindowsSpawnProgram } from "openclaw/plugin-sdk/windows-spawn";
 import { OPENCLAW_VERSION, embeddedAgentLog } from "openclaw/plugin-sdk/agent-harness-runtime";
 import { createInterface } from "node:readline";

package/dist/{client-factory-CPuoOOx6.js → client-factory-Bm6HsGob.js}

@@ -1,7 +1,7 @@
 //#region extensions/codex/src/app-server/client-factory.ts
 let sharedClientModulePromise = null;
 const loadSharedClientModule = async () => {
-	sharedClientModulePromise ??= import("./shared-client-Bg5d7VV9.js").then((n) => n.c);
+	sharedClientModulePromise ??= import("./shared-client-Dtx5i7Ez.js").then((n) => n.c);
 	return await sharedClientModulePromise;
 };
 /** Returns a leased shared client so startup can release ownership explicitly. */

package/dist/{command-handlers-CqS0Kv3Z.js → command-handlers-CLJjbqL9.js}

@@ -1,14 +1,14 @@
 import { n as isJsonObject } from "./protocol-dh-ETiNd.js";
-import { d as resolveCodexAppServerRuntimeOptions, o as isCodexFastServiceTier } from "./config-BksX0T33.js";
-import { n as listCodexAppServerModels, t as listAllCodexAppServerModels } from "./models-BsyV1Psm.js";
-import { l as summarizeCodexAccountUsage } from "./provider-qJygHQx4.js";
-import { l as writeCodexAppServerBinding, n as clearCodexAppServerBinding, o as readCodexAppServerBinding } from "./session-binding-BRUi8y6E.js";
-import { i as describeControlFailure, r as CODEX_CONTROL_METHODS } from "./plugin-app-cache-key-CN9zBiCG.js";
-import { a as formatCodexDisplayText, c as formatList, d as formatThreads, f as readString$1, i as formatAccount, l as formatModels, o as formatCodexStatus, r as buildHelp, s as formatComputerUseStatus, u as formatSkills } from "./app-server-policy-KpyUye2D.js";
+import { d as resolveCodexAppServerRuntimeOptions, o as isCodexFastServiceTier } from "./config-CszD0vP3.js";
+import { n as listCodexAppServerModels, t as listAllCodexAppServerModels } from "./models-CAmfBWRl.js";
+import { l as summarizeCodexAccountUsage } from "./provider-B-OHpbD3.js";
+import { l as writeCodexAppServerBinding, n as clearCodexAppServerBinding, o as readCodexAppServerBinding } from "./session-binding-HOuPt-E0.js";
+import { i as describeControlFailure, r as CODEX_CONTROL_METHODS } from "./plugin-app-cache-key-DX14mGOE.js";
+import { a as formatCodexDisplayText, c as formatList, d as formatThreads, f as readString$1, i as formatAccount, l as formatModels, o as formatCodexStatus, r as buildHelp, s as formatComputerUseStatus, u as formatSkills } from "./app-server-policy-BPTiVNsW.js";
 import { n as resolveCodexNativeExecutionBlock, r as resolveCodexNativeSandboxBlock } from "./sandbox-guard-3tnjhjFb.js";
-import { _ as steerCodexConversationTurn, b as readCodexConversationBindingData, d as parseCodexFastModeArg, f as parseCodexPermissionsModeArg, g as setCodexConversationPermissions, h as setCodexConversationModel, m as setCodexConversationFastMode, o as formatCodexCliSessions, p as readCodexConversationActiveTurn, r as startCodexConversationThread, u as formatPermissionsMode, v as stopCodexConversationTurn, x as resolveCodexDefaultWorkspaceDir, y as createCodexCliNodeConversationBindingData } from "./conversation-binding-DBof5w9J.js";
-import { t as requestCodexAppServerJson } from "./request-DTIEyUrA.js";
-import { n as installCodexComputerUse, r as readCodexComputerUseStatus } from "./computer-use-qLm7Gf35.js";
+import { _ as steerCodexConversationTurn, b as readCodexConversationBindingData, d as parseCodexFastModeArg, f as parseCodexPermissionsModeArg, g as setCodexConversationPermissions, h as setCodexConversationModel, m as setCodexConversationFastMode, o as formatCodexCliSessions, p as readCodexConversationActiveTurn, r as startCodexConversationThread, u as formatPermissionsMode, v as stopCodexConversationTurn, x as resolveCodexDefaultWorkspaceDir, y as createCodexCliNodeConversationBindingData } from "./conversation-binding-CndXa45M.js";
+import { t as requestCodexAppServerJson } from "./request-Dcd452Nk.js";
+import { n as installCodexComputerUse, r as readCodexComputerUseStatus } from "./computer-use-BViK8fu1.js";
 import { n as rememberCodexRateLimits } from "./rate-limit-cache-C7qmZ0Jh.js";
 import { parseStrictPositiveInteger } from "openclaw/plugin-sdk/number-runtime";
 import { normalizeOptionalString, normalizeUniqueStringEntries } from "openclaw/plugin-sdk/string-coerce-runtime";

package/dist/{compact-CMVlldii.js → compact-aQJ0ZKhe.js}

@@ -1,8 +1,8 @@
-import { d as resolveCodexAppServerRuntimeOptions } from "./config-BksX0T33.js";
-import { c as withCodexAppServerBindingLock, l as writeCodexAppServerBinding, o as readCodexAppServerBinding, t as CODEX_APP_SERVER_BINDING_GUARDED_REQUEST_TIMEOUT_MS } from "./session-binding-BRUi8y6E.js";
-import { o as releaseLeasedSharedCodexAppServerClient } from "./shared-client-Bg5d7VV9.js";
+import { d as resolveCodexAppServerRuntimeOptions } from "./config-CszD0vP3.js";
+import { c as withCodexAppServerBindingLock, l as writeCodexAppServerBinding, o as readCodexAppServerBinding, t as CODEX_APP_SERVER_BINDING_GUARDED_REQUEST_TIMEOUT_MS } from "./session-binding-HOuPt-E0.js";
+import { o as releaseLeasedSharedCodexAppServerClient } from "./shared-client-Dtx5i7Ez.js";
 import { n as resolveCodexNativeExecutionBlock } from "./sandbox-guard-3tnjhjFb.js";
-import { t as defaultLeasedCodexAppServerClientFactory } from "./client-factory-CPuoOOx6.js";
+import { t as defaultLeasedCodexAppServerClientFactory } from "./client-factory-Bm6HsGob.js";
 import { embeddedAgentLog } from "openclaw/plugin-sdk/agent-harness-runtime";
 //#region extensions/codex/src/app-server/compact.ts
 /**

package/dist/{computer-use-qLm7Gf35.js → computer-use-BViK8fu1.js}

@@ -1,6 +1,6 @@
-import { d as resolveCodexAppServerRuntimeOptions, f as resolveCodexComputerUseConfig } from "./config-BksX0T33.js";
-import { i as describeControlFailure } from "./plugin-app-cache-key-CN9zBiCG.js";
-import { t as requestCodexAppServerJson } from "./request-DTIEyUrA.js";
+import { d as resolveCodexAppServerRuntimeOptions, f as resolveCodexComputerUseConfig } from "./config-CszD0vP3.js";
+import { i as describeControlFailure } from "./plugin-app-cache-key-DX14mGOE.js";
+import { t as requestCodexAppServerJson } from "./request-Dcd452Nk.js";
 import { existsSync } from "node:fs";
 //#region extensions/codex/src/app-server/computer-use.ts
 /**

package/dist/{config-BksX0T33.js → config-CszD0vP3.js}

@@ -7,6 +7,7 @@ import { hostname } from "node:os";
 import { resolveProviderIdForAuth } from "openclaw/plugin-sdk/agent-runtime";
 import { resolveExecApprovalsFromFile } from "openclaw/plugin-sdk/exec-approvals-runtime";
 import { normalizeAgentId } from "openclaw/plugin-sdk/routing";
+import { buildSecretInputSchema, normalizeResolvedSecretInputString } from "openclaw/plugin-sdk/secret-input";
 import { detectWindowsSpawnCommandInlineArgs } from "openclaw/plugin-sdk/windows-spawn";
 import { z } from "zod";
 //#region extensions/codex/src/app-server/config.ts
@@ -26,6 +27,7 @@ const DEFAULT_CODEX_COMPUTER_USE_MCP_SERVER_NAME = "computer-use";
 const DEFAULT_CODEX_COMPUTER_USE_MARKETPLACE_DISCOVERY_TIMEOUT_MS = 6e4;
 const DEFAULT_CODEX_APP_SERVER_NETWORK_PROXY_PROFILE_PREFIX = "openclaw-network";
 const codexAppServerTransportSchema = z.enum(["stdio", "websocket"]);
+const SecretInputSchema = buildSecretInputSchema();
 const codexAppServerPolicyModeSchema = z.enum(["yolo", "guardian"]);
 const codexAppServerApprovalPolicySchema = z.enum([
 	"never",
@@ -101,8 +103,8 @@ const codexPluginConfigSchema = z.object({
 		command: z.string().optional(),
 		args: z.union([z.array(z.string()), z.string()]).optional(),
 		url: z.string().optional(),
-		authToken: z.string().optional(),
-		headers: z.record(z.string(), z.string()).optional(),
+		authToken: SecretInputSchema.optional(),
+		headers: z.record(z.string(), SecretInputSchema).optional(),
 		clearEnv: z.array(z.string()).optional(),
 		remoteWorkspaceRoot: codexAppServerRemoteWorkspaceRootSchema.optional(),
 		codeModeOnly: z.boolean().optional(),
@@ -189,7 +191,10 @@ function resolveCodexAppServerRuntimeOptions(params = {}) {
 	const args = resolveArgs(config.args, env.OPENCLAW_CODEX_APP_SERVER_ARGS);
 	const headers = normalizeHeaders(config.headers);
 	const clearEnv = normalizeStringList(config.clearEnv);
-	const authToken = readNonEmptyString(config.authToken);
+	const authToken = normalizeCodexAppServerSecretInput({
+		value: config.authToken,
+		path: "plugins.entries.codex.config.appServer.authToken"
+	});
 	const url = readNonEmptyString(config.url);
 	const connectionClass = inferCodexAppServerConnectionClass({
 		transport,
@@ -364,7 +369,7 @@ function codexAppServerStartOptionsKey(options, params = {}) {
 		args: options.args,
 		url: options.url ?? null,
 		authToken: hashSecretForKey(options.authToken, "authToken"),
-		headers: Object.entries(options.headers).toSorted(([left], [right]) => left.localeCompare(right)),
+		headers: Object.entries(options.headers).toSorted(([left], [right]) => left.localeCompare(right)).map(([key, value]) => [key, hashSecretForKey(value, `header:${key}`)]),
 		env: Object.entries(options.env ?? {}).toSorted(([left], [right]) => left.localeCompare(right)).map(([key, value]) => [key, hashSecretForKey(value, `env:${key}`)]),
 		clearEnv: [...options.clearEnv ?? []].toSorted(),
 		authProfileId: params.authProfileId ?? null,
@@ -1020,7 +1025,13 @@ function normalizePositiveNumber(value, fallback) {
 }
 function normalizeHeaders(value) {
 	if (!value || typeof value !== "object" || Array.isArray(value)) return {};
-	return Object.fromEntries(Object.entries(value).map(([key, child]) => [key.trim(), readNonEmptyString(child)]).filter((entry) => Boolean(entry[0] && entry[1])));
+	return Object.fromEntries(Object.entries(value).map(([key, child]) => [key.trim(), normalizeCodexAppServerSecretInput({
+		value: child,
+		path: `plugins.entries.codex.config.appServer.headers.${key}`
+	})]).filter((entry) => Boolean(entry[0] && entry[1])));
+}
+function normalizeCodexAppServerSecretInput(params) {
+	return normalizeResolvedSecretInputString(params);
 }
 function normalizeStringList(value) {
 	return normalizeTrimmedStringList(value);

package/dist/{conversation-binding-DBof5w9J.js → conversation-binding-CndXa45M.js}

@@ -1,11 +1,11 @@
 import { n as isJsonObject } from "./protocol-dh-ETiNd.js";
-import { B as readCodexNotificationThreadId, V as readCodexNotificationTurnId, d as resolveCodexAppServerRequestModelSelection, p as resolveCodexBindingModelProviderFallback, t as CODEX_NATIVE_PERSONALITY_NONE } from "./thread-lifecycle-CbJqqnEw.js";
-import { d as resolveCodexAppServerRuntimeOptions, h as resolveOpenClawExecPolicyForCodexAppServer, i as codexSandboxPolicyForTurn, n as canUseCodexModelBackedApprovalsReviewerForModel, o as isCodexFastServiceTier, p as resolveCodexModelBackedReviewerPolicyContext } from "./config-BksX0T33.js";
+import { H as readCodexNotificationTurnId, V as readCodexNotificationThreadId, d as resolveCodexAppServerRequestModelSelection, p as resolveCodexBindingModelProviderFallback, t as CODEX_NATIVE_PERSONALITY_NONE } from "./thread-lifecycle-CJdHuthD.js";
+import { d as resolveCodexAppServerRuntimeOptions, h as resolveOpenClawExecPolicyForCodexAppServer, i as codexSandboxPolicyForTurn, n as canUseCodexModelBackedApprovalsReviewerForModel, o as isCodexFastServiceTier, p as resolveCodexModelBackedReviewerPolicyContext } from "./config-CszD0vP3.js";
 import { r as assertCodexThreadStartResponse } from "./protocol-validators-B19q5BIX.js";
-import { a as normalizeCodexAppServerBindingModelProvider, i as isCodexAppServerNativeAuthProfile, l as writeCodexAppServerBinding, n as clearCodexAppServerBinding, o as readCodexAppServerBinding } from "./session-binding-BRUi8y6E.js";
-import { r as CODEX_CONTROL_METHODS } from "./plugin-app-cache-key-CN9zBiCG.js";
-import { a as formatCodexDisplayText, t as resolveCodexAppServerForModelProvider } from "./app-server-policy-KpyUye2D.js";
-import { a as getLeasedSharedCodexAppServerClient, o as releaseLeasedSharedCodexAppServerClient, p as resolveCodexAppServerAuthProfileIdForAgent } from "./shared-client-Bg5d7VV9.js";
+import { a as normalizeCodexAppServerBindingModelProvider, i as isCodexAppServerNativeAuthProfile, l as writeCodexAppServerBinding, n as clearCodexAppServerBinding, o as readCodexAppServerBinding } from "./session-binding-HOuPt-E0.js";
+import { r as CODEX_CONTROL_METHODS } from "./plugin-app-cache-key-DX14mGOE.js";
+import { a as formatCodexDisplayText, t as resolveCodexAppServerForModelProvider } from "./app-server-policy-BPTiVNsW.js";
+import { a as getLeasedSharedCodexAppServerClient, o as releaseLeasedSharedCodexAppServerClient, p as resolveCodexAppServerAuthProfileIdForAgent } from "./shared-client-Dtx5i7Ez.js";
 import { n as resolveCodexNativeExecutionBlock, r as resolveCodexNativeSandboxBlock } from "./sandbox-guard-3tnjhjFb.js";
 import fs from "node:fs/promises";
 import path from "node:path";

package/dist/harness.js

@@ -32,25 +32,25 @@ function createCodexAppServerAgentHarness(options) {
 			};
 		},
 		runAttempt: async (params) => {
-			const { runCodexAppServerAttempt } = await import("./run-attempt-DRhB6bTc.js");
+			const { runCodexAppServerAttempt } = await import("./run-attempt-4z6t1PlH.js");
 			return runCodexAppServerAttempt(params, {
 				pluginConfig: options?.resolvePluginConfig?.() ?? options?.pluginConfig,
 				nativeHookRelay: { enabled: true }
 			});
 		},
 		runSideQuestion: async (params) => {
-			const { runCodexAppServerSideQuestion } = await import("./side-question-BdYL4kj1.js");
+			const { runCodexAppServerSideQuestion } = await import("./side-question-BO7GbMFO.js");
 			return runCodexAppServerSideQuestion(params, {
 				pluginConfig: options?.resolvePluginConfig?.() ?? options?.pluginConfig,
 				nativeHookRelay: { enabled: true }
 			});
 		},
 		compact: async (params) => {
-			const { maybeCompactCodexAppServerSession } = await import("./compact-CMVlldii.js");
+			const { maybeCompactCodexAppServerSession } = await import("./compact-aQJ0ZKhe.js");
 			return maybeCompactCodexAppServerSession(params, { pluginConfig: options?.resolvePluginConfig?.() ?? options?.pluginConfig });
 		},
 		compactAfterContextEngine: async (params) => {
-			const { maybeCompactCodexAppServerSession } = await import("./compact-CMVlldii.js");
+			const { maybeCompactCodexAppServerSession } = await import("./compact-aQJ0ZKhe.js");
 			return maybeCompactCodexAppServerSession(params, {
 				pluginConfig: options?.resolvePluginConfig?.() ?? options?.pluginConfig,
 				allowNonManualNativeRequest: true
@@ -58,12 +58,12 @@ function createCodexAppServerAgentHarness(options) {
 		},
 		reset: async (params) => {
 			if (params.sessionFile) {
-				const { clearCodexAppServerBinding } = await import("./session-binding-BRUi8y6E.js").then((n) => n.s);
+				const { clearCodexAppServerBinding } = await import("./session-binding-HOuPt-E0.js").then((n) => n.s);
 				await clearCodexAppServerBinding(params.sessionFile);
 			}
 		},
 		dispose: async () => {
-			const { clearSharedCodexAppServerClientAndWait } = await import("./shared-client-Bg5d7VV9.js").then((n) => n.c);
+			const { clearSharedCodexAppServerClientAndWait } = await import("./shared-client-Dtx5i7Ez.js").then((n) => n.c);
 			await clearSharedCodexAppServerClientAndWait();
 		}
 	};

package/dist/index.js

@@ -1,13 +1,13 @@
 import { createCodexAppServerAgentHarness } from "./harness.js";
-import { F as pluginReadParams, L as defaultCodexAppInventoryCache, P as ensureCodexPluginActivation } from "./thread-lifecycle-CbJqqnEw.js";
-import { d as resolveCodexAppServerRuntimeOptions, t as CODEX_PLUGINS_MARKETPLACE_NAME, u as readCodexPluginConfig } from "./config-BksX0T33.js";
-import { t as buildCodexProvider } from "./provider-qJygHQx4.js";
-import { t as buildCodexMediaUnderstandingProvider } from "./media-understanding-provider-CiwPkR58.js";
-import { i as describeControlFailure, n as buildCodexPluginAppCacheKey } from "./plugin-app-cache-key-CN9zBiCG.js";
-import { a as formatCodexDisplayText } from "./app-server-policy-KpyUye2D.js";
-import { a as getLeasedSharedCodexAppServerClient, d as resolveCodexAppServerAuthAccountCacheKey, m as resolveCodexAppServerFallbackApiKeyCacheKey, o as releaseLeasedSharedCodexAppServerClient, p as resolveCodexAppServerAuthProfileIdForAgent, r as clearSharedCodexAppServerClientIfCurrentAndWait } from "./shared-client-Bg5d7VV9.js";
-import { a as createCodexCliSessionNodeInvokePolicies, c as resolveCodexCliSessionForBindingOnNode, i as createCodexCliSessionNodeHostCommands, l as resumeCodexCliSessionOnNode, n as handleCodexConversationInboundClaim, s as listCodexCliSessionsOnNode, t as handleCodexConversationBindingResolved } from "./conversation-binding-DBof5w9J.js";
-import { t as requestCodexAppServerJson } from "./request-DTIEyUrA.js";
+import { F as ensureCodexPluginActivation, I as pluginReadParams, R as defaultCodexAppInventoryCache } from "./thread-lifecycle-CJdHuthD.js";
+import { d as resolveCodexAppServerRuntimeOptions, t as CODEX_PLUGINS_MARKETPLACE_NAME, u as readCodexPluginConfig } from "./config-CszD0vP3.js";
+import { t as buildCodexProvider } from "./provider-B-OHpbD3.js";
+import { t as buildCodexMediaUnderstandingProvider } from "./media-understanding-provider-DSQ2ry-4.js";
+import { i as describeControlFailure, n as buildCodexPluginAppCacheKey } from "./plugin-app-cache-key-DX14mGOE.js";
+import { a as formatCodexDisplayText } from "./app-server-policy-BPTiVNsW.js";
+import { a as getLeasedSharedCodexAppServerClient, d as resolveCodexAppServerAuthAccountCacheKey, m as resolveCodexAppServerFallbackApiKeyCacheKey, o as releaseLeasedSharedCodexAppServerClient, p as resolveCodexAppServerAuthProfileIdForAgent, r as clearSharedCodexAppServerClientIfCurrentAndWait } from "./shared-client-Dtx5i7Ez.js";
+import { a as createCodexCliSessionNodeInvokePolicies, c as resolveCodexCliSessionForBindingOnNode, i as createCodexCliSessionNodeHostCommands, l as resumeCodexCliSessionOnNode, n as handleCodexConversationInboundClaim, s as listCodexCliSessionsOnNode, t as handleCodexConversationBindingResolved } from "./conversation-binding-CndXa45M.js";
+import { t as requestCodexAppServerJson } from "./request-Dcd452Nk.js";
 import { t as createCodexWebSearchProviderBase } from "./web-search-provider.shared-BrZmlqyR.js";
 import { mutateConfigFile } from "openclaw/plugin-sdk/config-mutation";
 import { resolveLivePluginConfigObject, resolvePluginConfigObject } from "openclaw/plugin-sdk/plugin-config-runtime";
@@ -52,7 +52,7 @@ async function handleCodexCommand(ctx, options = {}) {
 	}
 }
 async function loadDefaultCodexSubcommandHandler() {
-	const { handleCodexSubcommand } = await import("./command-handlers-CqS0Kv3Z.js");
+	const { handleCodexSubcommand } = await import("./command-handlers-CLJjbqL9.js");
 	return handleCodexSubcommand;
 }
 //#endregion
@@ -1542,7 +1542,7 @@ function buildCodexMigrationProvider(params = {}) {
 //#region extensions/codex/src/web-search-provider.ts
 let codexWebSearchRuntimePromise;
 function loadCodexWebSearchRuntime() {
-	codexWebSearchRuntimePromise ??= import("./web-search-provider.runtime-DrpQ8Cyd.js");
+	codexWebSearchRuntimePromise ??= import("./web-search-provider.runtime-CMEYazjn.js");
 	return codexWebSearchRuntimePromise;
 }
 const CodexWebSearchSchema = {

package/dist/{media-understanding-provider-CiwPkR58.js → media-understanding-provider-DSQ2ry-4.js}

@@ -1,10 +1,10 @@
 import { CODEX_PROVIDER_ID, FALLBACK_CODEX_MODELS } from "./provider-catalog.js";
 import { n as isJsonObject } from "./protocol-dh-ETiNd.js";
-import { M as mergeCodexThreadConfigs, r as buildCodexRuntimeThreadConfig } from "./thread-lifecycle-CbJqqnEw.js";
-import { S as readCodexNotificationItem } from "./attempt-notifications-Meja3TX6.js";
-import { d as resolveCodexAppServerRuntimeOptions } from "./config-BksX0T33.js";
+import { N as mergeCodexThreadConfigs, r as buildCodexRuntimeThreadConfig } from "./thread-lifecycle-CJdHuthD.js";
+import { S as readCodexNotificationItem } from "./attempt-notifications-C3zROmkk.js";
+import { d as resolveCodexAppServerRuntimeOptions } from "./config-CszD0vP3.js";
 import { i as assertCodexTurnStartResponse, l as readCodexTurnCompletedNotification, o as readCodexErrorNotification, r as assertCodexThreadStartResponse } from "./protocol-validators-B19q5BIX.js";
-import { i as readModelListResult } from "./models-BsyV1Psm.js";
+import { i as readModelListResult } from "./models-CAmfBWRl.js";
 import { validateJsonSchemaValue } from "openclaw/plugin-sdk/json-schema-runtime";
 import fs from "node:fs/promises";
 import path from "node:path";
@@ -51,7 +51,7 @@ async function runBoundedCodexAppServerTurnInWorkspace(params, appServer, worksp
 	const agentDir = params.agentDir?.trim() || void 0;
 	const startOptions = workspace.codexHome ? buildPrivateCodexAppServerStartOptions(appServer.start, workspace.codexHome) : appServer.start;
 	const ownsClient = !params.options.clientFactory;
-	const client = params.options.clientFactory ? await params.options.clientFactory(startOptions, params.profile, agentDir, params.config, { timeoutMs }) : await import("./shared-client-Bg5d7VV9.js").then((n) => n.c).then(({ createIsolatedCodexAppServerClient }) => createIsolatedCodexAppServerClient({
+	const client = params.options.clientFactory ? await params.options.clientFactory(startOptions, params.profile, agentDir, params.config, { timeoutMs }) : await import("./shared-client-Dtx5i7Ez.js").then((n) => n.c).then(({ createIsolatedCodexAppServerClient }) => createIsolatedCodexAppServerClient({
 		startOptions,
 		timeoutMs,
 		authProfileId: params.profile,

package/dist/media-understanding-provider.js

@@ -1,2 +1,2 @@
-import { t as buildCodexMediaUnderstandingProvider } from "./media-understanding-provider-CiwPkR58.js";
+import { t as buildCodexMediaUnderstandingProvider } from "./media-understanding-provider-DSQ2ry-4.js";
 export { buildCodexMediaUnderstandingProvider };

package/dist/{models-BsyV1Psm.js → models-CAmfBWRl.js}

@@ -46,7 +46,7 @@ async function listAllCodexAppServerModels(options = {}) {
 async function withCodexAppServerModelClient(options, run) {
 	const timeoutMs = options.timeoutMs ?? 2500;
 	const useSharedClient = options.sharedClient !== false;
-	const { createIsolatedCodexAppServerClient, getLeasedSharedCodexAppServerClient, releaseLeasedSharedCodexAppServerClient } = await import("./shared-client-Bg5d7VV9.js").then((n) => n.c);
+	const { createIsolatedCodexAppServerClient, getLeasedSharedCodexAppServerClient, releaseLeasedSharedCodexAppServerClient } = await import("./shared-client-Dtx5i7Ez.js").then((n) => n.c);
 	const client = useSharedClient ? await getLeasedSharedCodexAppServerClient({
 		startOptions: options.startOptions,
 		timeoutMs,

package/dist/{plugin-app-cache-key-CN9zBiCG.js → plugin-app-cache-key-DX14mGOE.js}

@@ -1,6 +1,6 @@
-import { I as buildCodexAppInventoryCacheKey } from "./thread-lifecycle-CbJqqnEw.js";
-import { n as CodexAppServerRpcError } from "./client-m7XiCQpO.js";
-import { h as resolveCodexAppServerHomeDir } from "./shared-client-Bg5d7VV9.js";
+import { L as buildCodexAppInventoryCacheKey } from "./thread-lifecycle-CJdHuthD.js";
+import { n as CodexAppServerRpcError } from "./client-CLrtWgrD.js";
+import { h as resolveCodexAppServerHomeDir } from "./shared-client-Dtx5i7Ez.js";
 import { createHash } from "node:crypto";
 //#region extensions/codex/src/app-server/capabilities.ts
 /**

package/dist/prompt-overlay.js

@@ -1,4 +1,4 @@
-import { GPT5_BEHAVIOR_CONTRACT, GPT5_HEARTBEAT_PROMPT_OVERLAY, renderGpt5PromptOverlay, resolveGpt5SystemPromptContribution } from "openclaw/plugin-sdk/provider-model-shared";
+import { GPT5_BEHAVIOR_CONTRACT, GPT5_HEARTBEAT_PROMPT_OVERLAY, resolveGpt5SystemPromptContribution } from "openclaw/plugin-sdk/provider-model-shared";
 //#region extensions/codex/prompt-overlay.ts
 /**
 * Codex prompt-overlay facade for GPT-5 behavior and heartbeat guidance.
@@ -11,9 +11,5 @@ const CODEX_GPT5_HEARTBEAT_PROMPT_OVERLAY = GPT5_HEARTBEAT_PROMPT_OVERLAY;
 function resolveCodexSystemPromptContribution(params) {
 	return resolveGpt5SystemPromptContribution(params);
 }
-/** Renders the Codex prompt overlay text for supported GPT-5-family models. */
-function renderCodexPromptOverlay(params) {
-	return renderGpt5PromptOverlay(params);
-}
 //#endregion
-export { CODEX_GPT5_BEHAVIOR_CONTRACT, CODEX_GPT5_HEARTBEAT_PROMPT_OVERLAY, renderCodexPromptOverlay, resolveCodexSystemPromptContribution };
+export { CODEX_GPT5_BEHAVIOR_CONTRACT, CODEX_GPT5_HEARTBEAT_PROMPT_OVERLAY, resolveCodexSystemPromptContribution };

package/dist/{provider-qJygHQx4.js → provider-B-OHpbD3.js}

@@ -1,6 +1,6 @@
 import { CODEX_APP_SERVER_AUTH_MARKER, CODEX_BASE_URL, CODEX_PROVIDER_ID, FALLBACK_CODEX_MODELS, buildCodexModelDefinition, buildCodexProviderConfig } from "./provider-catalog.js";
 import { n as isJsonObject } from "./protocol-dh-ETiNd.js";
-import { d as resolveCodexAppServerRuntimeOptions, u as readCodexPluginConfig } from "./config-BksX0T33.js";
+import { d as resolveCodexAppServerRuntimeOptions, u as readCodexPluginConfig } from "./config-CszD0vP3.js";
 import { resolveCodexSystemPromptContribution } from "./prompt-overlay.js";
 import { resolvePluginConfigObject } from "openclaw/plugin-sdk/plugin-config-runtime";
 import { MAX_DATE_TIMESTAMP_MS, resolveExpiresAtMsFromEpochSeconds } from "openclaw/plugin-sdk/number-runtime";
@@ -541,11 +541,11 @@ async function listModelsBestEffort(params) {
 	}
 }
 async function listCodexAppServerModelsLazy(options) {
-	const { listCodexAppServerModels } = await import("./models-BsyV1Psm.js").then((n) => n.r);
+	const { listCodexAppServerModels } = await import("./models-CAmfBWRl.js").then((n) => n.r);
 	return listCodexAppServerModels(options);
 }
 async function requestCodexAppServerRateLimitsLazy(options) {
-	const { requestCodexAppServerJson } = await import("./request-DTIEyUrA.js").then((n) => n.n);
+	const { requestCodexAppServerJson } = await import("./request-Dcd452Nk.js").then((n) => n.n);
 	return await requestCodexAppServerJson({
 		method: "account/rateLimits/read",
 		timeoutMs: options.timeoutMs,

package/dist/{provider-capabilities-BOvTfMhF.js → provider-capabilities-D2Ee9YEI.js}

@@ -1,8 +1,8 @@
 import { n as isJsonObject } from "./protocol-dh-ETiNd.js";
-import { C as isForcedPrivateQaCodexRuntime, S as filterCodexDynamicTools, _ as resolveCodexWebSearchPlan, w as normalizeCodexDynamicToolName, x as sanitizeInlineImageDataUrl, y as invalidInlineImageText } from "./thread-lifecycle-CbJqqnEw.js";
-import { c as isTrustedCodexModelBackedOpenAIProvider, u as readCodexPluginConfig } from "./config-BksX0T33.js";
-import { a as formatCodexDisplayText } from "./app-server-policy-KpyUye2D.js";
-import { o as releaseLeasedSharedCodexAppServerClient } from "./shared-client-Bg5d7VV9.js";
+import { C as isForcedPrivateQaCodexRuntime, S as filterCodexDynamicTools, _ as resolveCodexWebSearchPlan, w as normalizeCodexDynamicToolName, x as sanitizeInlineImageDataUrl, y as invalidInlineImageText } from "./thread-lifecycle-CJdHuthD.js";
+import { c as isTrustedCodexModelBackedOpenAIProvider, u as readCodexPluginConfig } from "./config-CszD0vP3.js";
+import { a as formatCodexDisplayText } from "./app-server-policy-BPTiVNsW.js";
+import { o as releaseLeasedSharedCodexAppServerClient } from "./shared-client-Dtx5i7Ez.js";
 import { i as resolveCodexNativeExecutionPolicy } from "./sandbox-guard-3tnjhjFb.js";
 import { addTimerTimeoutGraceMs, finiteSecondsToTimerSafeMilliseconds, resolveTimerTimeoutMs } from "openclaw/plugin-sdk/number-runtime";
 import { asOptionalRecord, isRecord, normalizeTrimmedStringList } from "openclaw/plugin-sdk/string-coerce-runtime";

package/dist/provider.js

@@ -1,2 +1,2 @@
-import { n as buildCodexProviderCatalog, r as isModernCodexModel, t as buildCodexProvider } from "./provider-qJygHQx4.js";
+import { n as buildCodexProviderCatalog, r as isModernCodexModel, t as buildCodexProvider } from "./provider-B-OHpbD3.js";
 export { buildCodexProvider, buildCodexProviderCatalog, isModernCodexModel };

package/dist/{request-DTIEyUrA.js → request-Dcd452Nk.js}

@@ -1,5 +1,5 @@
 import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
-import { a as getLeasedSharedCodexAppServerClient, i as createIsolatedCodexAppServerClient, l as withTimeout, o as releaseLeasedSharedCodexAppServerClient } from "./shared-client-Bg5d7VV9.js";
+import { a as getLeasedSharedCodexAppServerClient, i as createIsolatedCodexAppServerClient, l as withTimeout, o as releaseLeasedSharedCodexAppServerClient } from "./shared-client-Dtx5i7Ez.js";
 import { t as resolveCodexAppServerDirectSandboxBypassBlock } from "./sandbox-guard-3tnjhjFb.js";
 //#region extensions/codex/src/app-server/request.ts
 var request_exports = /* @__PURE__ */ __exportAll({ requestCodexAppServerJson: () => requestCodexAppServerJson });

package/dist/{run-attempt-DRhB6bTc.js → run-attempt-4z6t1PlH.js}

@@ -1,17 +1,17 @@
 import { n as isJsonObject, t as flattenCodexDynamicToolFunctions } from "./protocol-dh-ETiNd.js";
-import { A as buildCodexPluginThreadConfig, B as readCodexNotificationThreadId, D as projectContextEngineAssemblyForCodex, E as resolveCodexDynamicToolsLoadingForRuntime, L as defaultCodexAppInventoryCache, M as mergeCodexThreadConfigs, N as shouldBuildCodexPluginThreadConfig, O as resolveCodexContextEngineProjectionMaxChars, R as describeCodexNotificationCorrelation, V as readCodexNotificationTurnId, _ as resolveCodexWebSearchPlan, a as buildDeveloperInstructions, b as sanitizeCodexHistoryImagePayloads, c as codexDynamicToolsFingerprint, f as resolveCodexAppServerThreadModelSelection, h as startOrResumeThread, i as buildContextEngineBinding, j as buildCodexPluginThreadConfigInputFingerprint, k as resolveCodexContextEngineProjectionReserveTokens, l as isContextEngineBindingCompatible, n as areCodexDynamicToolFingerprintsCompatible, o as buildTurnCollaborationMode, s as buildTurnStartParams, v as isCodexAppServerProfilerEnabled } from "./thread-lifecycle-CbJqqnEw.js";
-import { C as readNotificationItemId, E as updateActiveTurnItemIds, S as readCodexNotificationItem, T as shouldDisarmAssistantCompletionIdleWatch, _ as isReasoningItemCompletionNotification, a as isCodexNotificationOutsideActiveRun, b as isTerminalTurnStatus, c as isCurrentThreadOptionalTurnRequestParams, d as isNativeResponseStreamDeltaNotification, f as isNativeToolProgressNotification, g as isRawToolOutputCompletionNotification, h as isRawReasoningCompletionNotification, i as isAssistantCompletionReleaseNotification, l as isCurrentThreadTurnRequestParams, m as isRawAssistantProgressNotification, n as describeNotificationActivity, o as isCodexTurnAbortMarkerNotification, p as isPendingOpenClawDynamicToolCompletionNotification, r as isAssistantCommentaryCompletionNotification, s as isCurrentApprovalTurnRequestParams, t as codexExecutionToolName, u as isFileChangePatchUpdatedNotification, v as isReasoningProgressNotification, w as readRawResponseToolCallId, x as isTurnNotification, y as isRetryableErrorNotification } from "./attempt-notifications-Meja3TX6.js";
-import { _ as withMcpElicitationsApprovalPolicy, a as isCodexAppServerApprovalPolicyAllowedByRequirements, d as resolveCodexAppServerRuntimeOptions, f as resolveCodexComputerUseConfig, g as shouldAutoApproveCodexAppServerApprovals, h as resolveOpenClawExecPolicyForCodexAppServer, m as resolveCodexPluginsPolicy, p as resolveCodexModelBackedReviewerPolicyContext, s as isCodexSandboxExecServerEnabled, u as readCodexPluginConfig } from "./config-BksX0T33.js";
+import { A as resolveCodexContextEngineProjectionReserveTokens, D as fitCodexProjectedContextForTurnStart, E as resolveCodexDynamicToolsLoadingForRuntime, H as readCodexNotificationTurnId, M as buildCodexPluginThreadConfigInputFingerprint, N as mergeCodexThreadConfigs, O as projectContextEngineAssemblyForCodex, P as shouldBuildCodexPluginThreadConfig, R as defaultCodexAppInventoryCache, V as readCodexNotificationThreadId, _ as resolveCodexWebSearchPlan, a as buildDeveloperInstructions, b as sanitizeCodexHistoryImagePayloads, c as codexDynamicToolsFingerprint, f as resolveCodexAppServerThreadModelSelection, h as startOrResumeThread, i as buildContextEngineBinding, j as buildCodexPluginThreadConfig, k as resolveCodexContextEngineProjectionMaxChars, l as isContextEngineBindingCompatible, n as areCodexDynamicToolFingerprintsCompatible, o as buildTurnCollaborationMode, s as buildTurnStartParams, v as isCodexAppServerProfilerEnabled, z as describeCodexNotificationCorrelation } from "./thread-lifecycle-CJdHuthD.js";
+import { C as readNotificationItemId, E as updateActiveTurnItemIds, S as readCodexNotificationItem, T as shouldDisarmAssistantCompletionIdleWatch, _ as isReasoningItemCompletionNotification, a as isCodexNotificationOutsideActiveRun, b as isTerminalTurnStatus, c as isCurrentThreadOptionalTurnRequestParams, d as isNativeResponseStreamDeltaNotification, f as isNativeToolProgressNotification, g as isRawToolOutputCompletionNotification, h as isRawReasoningCompletionNotification, i as isAssistantCompletionReleaseNotification, l as isCurrentThreadTurnRequestParams, m as isRawAssistantProgressNotification, n as describeNotificationActivity, o as isCodexTurnAbortMarkerNotification, p as isPendingOpenClawDynamicToolCompletionNotification, r as isAssistantCommentaryCompletionNotification, s as isCurrentApprovalTurnRequestParams, t as codexExecutionToolName, u as isFileChangePatchUpdatedNotification, v as isReasoningProgressNotification, w as readRawResponseToolCallId, x as isTurnNotification, y as isRetryableErrorNotification } from "./attempt-notifications-C3zROmkk.js";
+import { _ as withMcpElicitationsApprovalPolicy, a as isCodexAppServerApprovalPolicyAllowedByRequirements, d as resolveCodexAppServerRuntimeOptions, f as resolveCodexComputerUseConfig, g as shouldAutoApproveCodexAppServerApprovals, h as resolveOpenClawExecPolicyForCodexAppServer, m as resolveCodexPluginsPolicy, p as resolveCodexModelBackedReviewerPolicyContext, s as isCodexSandboxExecServerEnabled, u as readCodexPluginConfig } from "./config-CszD0vP3.js";
 import { a as readCodexDynamicToolCallParams, c as readCodexTurn, i as assertCodexTurnStartResponse } from "./protocol-validators-B19q5BIX.js";
-import { i as formatCodexUsageLimitErrorMessage, o as resolveCodexUsageLimitResetAtMs, s as shouldRefreshCodexRateLimitsForUsageLimitMessage } from "./provider-qJygHQx4.js";
-import { a as isCodexAppServerConnectionClosedError, i as isCodexAppServerApprovalRequest, n as CodexAppServerRpcError, r as compareCodexAppServerVersions, s as MIN_CODEX_SANDBOX_EXEC_SERVER_APP_SERVER_VERSION } from "./client-m7XiCQpO.js";
-import { i as isCodexAppServerNativeAuthProfile, l as writeCodexAppServerBinding, n as clearCodexAppServerBinding, o as readCodexAppServerBinding, r as clearCodexAppServerBindingForThread } from "./session-binding-BRUi8y6E.js";
-import { n as buildCodexPluginAppCacheKey, r as CODEX_CONTROL_METHODS, t as buildCodexAppServerRuntimeFingerprint } from "./plugin-app-cache-key-CN9zBiCG.js";
-import { a as formatCodexDisplayText, n as resolveCodexAppServerForOpenClawToolPolicy, t as resolveCodexAppServerForModelProvider } from "./app-server-policy-KpyUye2D.js";
-import { d as resolveCodexAppServerAuthAccountCacheKey, f as resolveCodexAppServerAuthProfileId, h as resolveCodexAppServerHomeDir, m as resolveCodexAppServerFallbackApiKeyCacheKey, n as clearSharedCodexAppServerClientIfCurrentAndUnclaimed, o as releaseLeasedSharedCodexAppServerClient, p as resolveCodexAppServerAuthProfileIdForAgent, s as retireSharedCodexAppServerClientIfCurrent, t as clearSharedCodexAppServerClientIfCurrent, u as refreshCodexAppServerAuthTokens } from "./shared-client-Bg5d7VV9.js";
-import { t as defaultLeasedCodexAppServerClientFactory } from "./client-factory-CPuoOOx6.js";
-import { A as CODEX_POST_REASONING_REPLY_IDLE_TIMEOUT_MS, C as resolveCodexMessageToolProvider, D as shouldWarnCodexDynamicToolBuildStageSummary, E as shouldRequireCodexSandboxExecServerEnvironment, F as resolveCodexTurnTerminalIdleTimeoutMs, I as withCodexStartupTimeout, M as resolveCodexStartupTimeoutMs, N as resolveCodexTurnAssistantCompletionIdleTimeoutMs, P as resolveCodexTurnCompletionIdleTimeoutMs, S as resolveCodexExternalSandboxPolicyForOpenClawSandbox, T as shouldEnableCodexAppServerNativeToolSurface, _ as createCodexDynamicToolBuildStageTracker, a as buildCodexNativeHookRelayConfig, b as resolveCodexAppServerExecutionCwd, c as resolveCodexNativeHookRelayEvents, d as handleCodexAppServerElicitationRequest, f as createCodexDynamicToolBridge, g as buildDynamicTools, h as emitDynamicToolTerminalDiagnostic, i as CODEX_NATIVE_HOOK_RELAY_TTL_GRACE_MS, j as resolveCodexPostToolRawAssistantCompletionIdleTimeoutMs, k as handleCodexAppServerApprovalRequest, l as resolveCodexNativeHookRelayTtlMs, m as emitDynamicToolStartedDiagnostic, o as buildCodexNativeHookRelayDisabledConfig, p as emitDynamicToolErrorDiagnostic, s as createCodexNativeHookRelay, t as resolveCodexProviderWebSearchSupport, u as scheduleCodexNativeHookRelayUnregister, v as disableCodexPluginThreadConfig, w as resolveCodexSandboxEnvironmentSelection, x as resolveCodexAppServerHookChannelId, y as formatCodexDynamicToolBuildStageSummary } from "./provider-capabilities-BOvTfMhF.js";
-import { t as ensureCodexComputerUse } from "./computer-use-qLm7Gf35.js";
+import { i as formatCodexUsageLimitErrorMessage, o as resolveCodexUsageLimitResetAtMs, s as shouldRefreshCodexRateLimitsForUsageLimitMessage } from "./provider-B-OHpbD3.js";
+import { a as isCodexAppServerConnectionClosedError, i as isCodexAppServerApprovalRequest, n as CodexAppServerRpcError, r as compareCodexAppServerVersions, s as MIN_CODEX_SANDBOX_EXEC_SERVER_APP_SERVER_VERSION } from "./client-CLrtWgrD.js";
+import { i as isCodexAppServerNativeAuthProfile, l as writeCodexAppServerBinding, n as clearCodexAppServerBinding, o as readCodexAppServerBinding, r as clearCodexAppServerBindingForThread } from "./session-binding-HOuPt-E0.js";
+import { n as buildCodexPluginAppCacheKey, r as CODEX_CONTROL_METHODS, t as buildCodexAppServerRuntimeFingerprint } from "./plugin-app-cache-key-DX14mGOE.js";
+import { a as formatCodexDisplayText, n as resolveCodexAppServerForOpenClawToolPolicy, t as resolveCodexAppServerForModelProvider } from "./app-server-policy-BPTiVNsW.js";
+import { d as resolveCodexAppServerAuthAccountCacheKey, f as resolveCodexAppServerAuthProfileId, h as resolveCodexAppServerHomeDir, m as resolveCodexAppServerFallbackApiKeyCacheKey, n as clearSharedCodexAppServerClientIfCurrentAndUnclaimed, o as releaseLeasedSharedCodexAppServerClient, p as resolveCodexAppServerAuthProfileIdForAgent, s as retireSharedCodexAppServerClientIfCurrent, t as clearSharedCodexAppServerClientIfCurrent, u as refreshCodexAppServerAuthTokens } from "./shared-client-Dtx5i7Ez.js";
+import { t as defaultLeasedCodexAppServerClientFactory } from "./client-factory-Bm6HsGob.js";
+import { A as CODEX_POST_REASONING_REPLY_IDLE_TIMEOUT_MS, C as resolveCodexMessageToolProvider, D as shouldWarnCodexDynamicToolBuildStageSummary, E as shouldRequireCodexSandboxExecServerEnvironment, F as resolveCodexTurnTerminalIdleTimeoutMs, I as withCodexStartupTimeout, M as resolveCodexStartupTimeoutMs, N as resolveCodexTurnAssistantCompletionIdleTimeoutMs, P as resolveCodexTurnCompletionIdleTimeoutMs, S as resolveCodexExternalSandboxPolicyForOpenClawSandbox, T as shouldEnableCodexAppServerNativeToolSurface, _ as createCodexDynamicToolBuildStageTracker, a as buildCodexNativeHookRelayConfig, b as resolveCodexAppServerExecutionCwd, c as resolveCodexNativeHookRelayEvents, d as handleCodexAppServerElicitationRequest, f as createCodexDynamicToolBridge, g as buildDynamicTools, h as emitDynamicToolTerminalDiagnostic, i as CODEX_NATIVE_HOOK_RELAY_TTL_GRACE_MS, j as resolveCodexPostToolRawAssistantCompletionIdleTimeoutMs, k as handleCodexAppServerApprovalRequest, l as resolveCodexNativeHookRelayTtlMs, m as emitDynamicToolStartedDiagnostic, o as buildCodexNativeHookRelayDisabledConfig, p as emitDynamicToolErrorDiagnostic, s as createCodexNativeHookRelay, t as resolveCodexProviderWebSearchSupport, u as scheduleCodexNativeHookRelayUnregister, v as disableCodexPluginThreadConfig, w as resolveCodexSandboxEnvironmentSelection, x as resolveCodexAppServerHookChannelId, y as formatCodexDynamicToolBuildStageSummary } from "./provider-capabilities-D2Ee9YEI.js";
+import { t as ensureCodexComputerUse } from "./computer-use-BViK8fu1.js";
 import { n as rememberCodexRateLimits, t as readRecentCodexRateLimits } from "./rate-limit-cache-C7qmZ0Jh.js";
 import fs from "node:fs/promises";
 import path, { posix } from "node:path";
@@ -21,7 +21,7 @@ import { createHash, randomUUID } from "node:crypto";
 import fsSync from "node:fs";
 import { markAuthProfileBlockedUntil, resolveAgentDir, resolveAgentWorkspaceDir } from "openclaw/plugin-sdk/agent-runtime";
 import { loadExecApprovals } from "openclaw/plugin-sdk/exec-approvals-runtime";
-import { CODEX_APP_SERVER_CONTEXT_ENGINE_HOST, TOOL_PROGRESS_OUTPUT_MAX_CHARS, acquireSessionWriteLock, appendSessionTranscriptMessage, assembleHarnessContextEngine, assertContextEngineHostSupport, awaitAgentHarnessAgentEndHook, bootstrapHarnessContextEngine, buildBootstrapContextForFiles, buildHarnessContextEngineRuntimeContext, buildHarnessContextEngineRuntimeContextFromUsage, classifyAgentHarnessTerminalOutcome, clearActiveEmbeddedRun, embeddedAgentLog, emitAgentEvent, emitSessionTranscriptUpdate, finalizeHarnessContextEngineTurn, formatErrorMessage, formatToolAggregate, formatToolProgressOutput, getAgentHarnessHookRunner, getBeforeToolCallPolicyDiagnosticState, inferToolMetaFromArgs, isActiveHarnessContextEngine, loadCodexBundleMcpThreadConfig, normalizeUsage, resolveAgentHarnessBeforePromptBuildResult, resolveBootstrapFilesForRun, resolveContextEngineOwnerPluginId, resolveSandboxContext, resolveSessionAgentIds as resolveSessionAgentIds$1, resolveSessionWriteLockOptions, resolveUserPath, runAgentCleanupStep, runAgentHarnessAfterCompactionHook, runAgentHarnessAfterToolCallHook, runAgentHarnessAgentEndHook, runAgentHarnessBeforeCompactionHook, runAgentHarnessBeforeMessageWriteHook, runAgentHarnessLlmInputHook, runAgentHarnessLlmOutputHook, runHarnessContextEngineMaintenance, setActiveEmbeddedRun, supportsModelTools } from "openclaw/plugin-sdk/agent-harness-runtime";
+import { CODEX_APP_SERVER_CONTEXT_ENGINE_HOST, TOOL_PROGRESS_OUTPUT_MAX_CHARS, acquireSessionWriteLock, appendSessionTranscriptMessage, assembleHarnessContextEngine, assertContextEngineHostSupport, awaitAgentEndSideEffects, bootstrapHarnessContextEngine, buildBootstrapContextForFiles, buildHarnessContextEngineRuntimeContext, buildHarnessContextEngineRuntimeContextFromUsage, classifyAgentHarnessTerminalOutcome, clearActiveEmbeddedRun, embeddedAgentLog, emitAgentEvent, emitSessionTranscriptUpdate, finalizeHarnessContextEngineTurn, formatErrorMessage, formatToolAggregate, formatToolProgressOutput, getAgentHarnessHookRunner, getBeforeToolCallPolicyDiagnosticState, inferToolMetaFromArgs, isActiveHarnessContextEngine, loadCodexBundleMcpThreadConfig, normalizeUsage, resolveAgentHarnessBeforePromptBuildResult, resolveBootstrapFilesForRun, resolveContextEngineOwnerPluginId, resolveSandboxContext, resolveSessionAgentIds as resolveSessionAgentIds$1, resolveSessionWriteLockOptions, resolveUserPath, runAgentCleanupStep, runAgentEndSideEffects, runAgentHarnessAfterCompactionHook, runAgentHarnessAfterToolCallHook, runAgentHarnessBeforeCompactionHook, runAgentHarnessBeforeMessageWriteHook, runAgentHarnessLlmInputHook, runAgentHarnessLlmOutputHook, runHarnessContextEngineMaintenance, setActiveEmbeddedRun, supportsModelTools } from "openclaw/plugin-sdk/agent-harness-runtime";
 import { buildMemorySystemPromptAddition } from "openclaw/plugin-sdk/core";
 import { spawn } from "node:child_process";
 import { once } from "node:events";
@@ -528,6 +528,25 @@ function prependCodexOpenClawPromptContext(prompt, context, options = {}) {
 		promptSection
 	].filter(Boolean).join("\n\n");
 }
+/**
+* Maps the surviving user-request portion of an input range after delivery
+* metadata has been relocated before the request.
+*/
+function resolveCodexDeliveryHintPreservedInputRange(params) {
+	const { prompt, promptInputRange, decoratedPrompt } = params;
+	const { deliveryHint, prompt: promptWithoutDeliveryHint } = splitLeadingCodexDeliveryHint(prompt);
+	if (!deliveryHint || !promptInputRange || promptInputRange.start < 0 || promptInputRange.end < promptInputRange.start || promptInputRange.end > prompt.length || !decoratedPrompt.endsWith(promptWithoutDeliveryHint)) return;
+	const promptWithoutDeliveryHintStart = prompt.length - promptWithoutDeliveryHint.length;
+	const inputStart = Math.max(promptInputRange.start, promptWithoutDeliveryHintStart);
+	const inputEnd = Math.max(inputStart, Math.min(promptInputRange.end, promptWithoutDeliveryHint.length + promptWithoutDeliveryHintStart));
+	const decoratedPromptSuffixStart = decoratedPrompt.length - promptWithoutDeliveryHint.length;
+	const requestHeader = "Current user request:\n";
+	const requestHeaderStart = decoratedPromptSuffixStart - 22;
+	return {
+		start: inputStart === promptWithoutDeliveryHintStart && decoratedPrompt.slice(requestHeaderStart, decoratedPromptSuffixStart) === requestHeader ? requestHeaderStart : decoratedPromptSuffixStart + inputStart - promptWithoutDeliveryHintStart,
+		end: decoratedPromptSuffixStart + inputEnd - promptWithoutDeliveryHintStart
+	};
+}
 function splitLeadingCodexDeliveryHint(prompt) {
 	const trimmedStart = prompt.trimStart();
 	const matchedHint = MESSAGE_TOOL_DELIVERY_HINTS.find((hint) => trimmedStart.startsWith(hint));
@@ -6137,25 +6156,58 @@ var CodexNativeSubagentMonitor = class {
 				continue;
 			}
 			const completion = toThreadCompletion(nativeCompletion, childState.childThreadId);
-			if (shouldWaitForTranscriptCompletion(completion, this.codexHome)) {
-				const eventAt = Date.now();
-				if (!await this.reconcileChildTranscript(childState.childThreadId)) {
-					this.scheduleTranscriptPoll(childState);
-					this.scheduleNoFinalCompletionFallback(state, childState, completion, eventAt);
-				}
-				continue;
-			}
-			await this.processCompletion(state, completion);
+			await this.processChildCompletion(state, childState, completion);
 		}
 	}
 	captureChildAssistantMessage(notification) {
-		if (notification.method !== "item/completed") return;
 		const params = isJsonObject(notification.params) ? notification.params : void 0;
 		const childThreadId = readString$2(params, "threadId")?.trim();
 		const childState = childThreadId ? this.childStates.get(childThreadId) : void 0;
+		if (!childState || childState.transcriptTerminal) return;
+		if (notification.method === "item/agentMessage/delta") {
+			const turnId = readString$2(params, "turnId");
+			const itemId = readString$2(params, "itemId");
+			const delta = readString$2(params, "delta");
+			if (turnId && itemId && delta) this.recordChildAssistantMessage(childState, turnId, itemId, delta);
+			return;
+		}
+		if (notification.method !== "item/started" && notification.method !== "item/completed") return;
+		const turnId = readString$2(params, "turnId");
 		const item = isJsonObject(params?.item) ? params.item : void 0;
-		const text = readString$2(item, "type") === "agentMessage" ? normalizeOptionalString(readString$2(item, "text")) : void 0;
-		if (childState && text) childState.lastAssistantMessage = text;
+		this.captureChildAssistantMessageItem(childState, turnId, item);
+	}
+	captureChildAssistantMessageItem(childState, turnId, item) {
+		if (readString$2(item, "type") !== "agentMessage") return;
+		const itemId = readString$2(item, "id");
+		if (!turnId || !itemId) return;
+		const assistantMessages = this.getChildAssistantMessages(childState, turnId);
+		if (readString$2(item, "phase") === "commentary") assistantMessages.commentaryIds.add(itemId);
+		else assistantMessages.finalMessageIds.add(itemId);
+		const text = readString$2(item, "text");
+		if (text) this.recordChildAssistantMessage(childState, turnId, itemId, text, { replace: true });
+	}
+	captureChildTurnAssistantMessages(childState, turn) {
+		const turnId = readString$2(turn, "id");
+		if (!turnId || !Array.isArray(turn.items)) return;
+		for (const item of turn.items) this.captureChildAssistantMessageItem(childState, turnId, isJsonObject(item) ? item : void 0);
+	}
+	recordChildAssistantMessage(childState, turnId, itemId, text, options = {}) {
+		const assistantMessages = this.getChildAssistantMessages(childState, turnId);
+		if (!assistantMessages.texts.has(itemId)) assistantMessages.order.push(itemId);
+		const existing = assistantMessages.texts.get(itemId) ?? "";
+		assistantMessages.texts.set(itemId, options.replace ? text : `${existing}${text}`);
+	}
+	getChildAssistantMessages(childState, turnId) {
+		const existing = childState.assistantMessagesByTurn.get(turnId);
+		if (existing) return existing;
+		const assistantMessages = {
+			texts: /* @__PURE__ */ new Map(),
+			order: [],
+			commentaryIds: /* @__PURE__ */ new Set(),
+			finalMessageIds: /* @__PURE__ */ new Set()
+		};
+		childState.assistantMessagesByTurn.set(turnId, assistantMessages);
+		return assistantMessages;
 	}
 	async handleChildTurnCompletion(notification) {
 		if (notification.method !== "turn/completed") return;
@@ -6164,8 +6216,25 @@ var CodexNativeSubagentMonitor = class {
 		const childState = childThreadId ? this.childStates.get(childThreadId) : void 0;
 		const state = childState ? this.parentStates.get(childState.parentThreadId) : void 0;
 		const turn = isJsonObject(params?.turn) ? params.turn : void 0;
+		if (childState && turn && readString$2(turn, "status") === "interrupted") {
+			const turnId = readString$2(turn, "id");
+			if (turnId) childState.assistantMessagesByTurn.delete(turnId);
+			return;
+		}
+		if (childState && turn) this.captureChildTurnAssistantMessages(childState, turn);
 		const completion = childState && turn ? toChildTurnCompletion(childState, turn) : void 0;
 		if (!state || !childState || childState.transcriptTerminal || !completion) return;
+		await this.processChildCompletion(state, childState, completion);
+	}
+	async processChildCompletion(state, childState, completion) {
+		if (shouldWaitForTranscriptCompletion(completion, this.codexHome)) {
+			const eventAt = Date.now();
+			if (!await this.reconcileChildTranscript(childState.childThreadId)) {
+				this.scheduleTranscriptPoll(childState);
+				this.scheduleNoFinalCompletionFallback(state, childState, completion, eventAt);
+			}
+			return;
+		}
 		await this.processCompletion(state, completion);
 	}
 	async reconcileChildTranscript(childThreadId, options = {}) {
@@ -6325,6 +6394,7 @@ var CodexNativeSubagentMonitor = class {
 			childState = {
 				childThreadId: normalizedChildThreadId,
 				parentThreadId: normalizedParentThreadId,
+				assistantMessagesByTurn: /* @__PURE__ */ new Map(),
 				transcriptPollAttempt: 0,
 				transcriptTerminal: false,
 				completionDeliveryAttempt: 0
@@ -6522,18 +6592,16 @@ function buildCompletionDedupeKey(parentThreadId, completion) {
 }
 function toChildTurnCompletion(childState, turn) {
 	const status = readString$2(turn, "status");
-	if (status === "completed") return {
-		childThreadId: childState.childThreadId,
-		status: "succeeded",
-		statusLabel: "turn_completed",
-		result: childState.lastAssistantMessage ?? "Codex native subagent completed without a final assistant message."
-	};
-	if (status === "interrupted") return {
-		childThreadId: childState.childThreadId,
-		status: "cancelled",
-		statusLabel: "turn_interrupted",
-		result: "Codex native subagent was interrupted."
-	};
+	if (status === "completed") {
+		const turnId = readString$2(turn, "id");
+		const result = turnId ? lastChildAssistantMessage(childState, turnId) : void 0;
+		return {
+			childThreadId: childState.childThreadId,
+			status: "succeeded",
+			statusLabel: result ? "turn_completed" : "completed_without_final_message",
+			result: result ?? "Codex native subagent completed without a final assistant message."
+		};
+	}
 	if (status === "failed") return {
 		childThreadId: childState.childThreadId,
 		status: "failed",
@@ -6541,6 +6609,17 @@ function toChildTurnCompletion(childState, turn) {
 		result: readTurnErrorMessage(turn) ?? "Codex native subagent failed."
 	};
 }
+function lastChildAssistantMessage(childState, turnId) {
+	const assistantMessages = childState.assistantMessagesByTurn.get(turnId);
+	if (!assistantMessages) return;
+	for (let index = assistantMessages.order.length - 1; index >= 0; index -= 1) {
+		const itemId = assistantMessages.order[index];
+		if (assistantMessages.finalMessageIds.has(itemId) && !assistantMessages.commentaryIds.has(itemId)) {
+			const text = normalizeOptionalString(assistantMessages.texts.get(itemId));
+			if (text) return text;
+		}
+	}
+}
 function readTurnErrorMessage(turn) {
 	const error = isJsonObject(turn.error) ? turn.error : void 0;
 	return normalizeOptionalString(readString$2(error, "message")) ?? normalizeOptionalString(isJsonObject(error?.codexErrorInfo) ? readString$2(error.codexErrorInfo, "message") : void 0);
@@ -7591,11 +7670,18 @@ function shouldAwaitCodexAgentEndHook(params) {
 	return !params.messageChannel && !params.messageProvider;
 }
 async function runCodexAgentEndHook(params, hookParams) {
+	const sideEffectParams = {
+		...hookParams,
+		ctx: {
+			...hookParams.ctx,
+			config: params.config
+		}
+	};
 	if (shouldAwaitCodexAgentEndHook(params)) {
-		await awaitAgentHarnessAgentEndHook(hookParams);
+		await awaitAgentEndSideEffects(sideEffectParams);
 		return;
 	}
-	runAgentHarnessAgentEndHook(hookParams);
+	runAgentEndSideEffects(sideEffectParams);
 }
 async function runCodexAppServerAttempt(params, options = {}) {
 	const attemptStartedAt = Date.now();
@@ -7996,8 +8082,13 @@ async function runCodexAppServerAttempt(params, options = {}) {
 		skillsPrompt: params.skillsSnapshot?.prompt
 	});
 	let promptText = params.prompt;
+	let promptContextRange;
 	let developerInstructions = baseDeveloperInstructions;
 	let prePromptMessageCount = historyMessages.length;
+	const codexContextProjectionMaxChars = resolveCodexContextEngineProjectionMaxChars({
+		contextTokenBudget: params.contextTokenBudget,
+		reserveTokens: resolveCodexContextEngineProjectionReserveTokens({ config: params.config })
+	});
 	let contextEngineProjection;
 	let precomputedStaleBindingContinuityProjectionApplied = false;
 	let staleBindingContinuityForcedFreshStart = false;
@@ -8006,9 +8097,11 @@ async function runCodexAppServerAttempt(params, options = {}) {
 		const projection = projectContextEngineAssemblyForCodex({
 			assembledMessages: historyMessages,
 			originalHistoryMessages: historyMessages,
-			prompt: params.prompt
+			prompt: params.prompt,
+			maxRenderedContextChars: codexContextProjectionMaxChars
 		});
 		promptText = projection.promptText;
+		promptContextRange = projection.promptContextRange;
 		prePromptMessageCount = projection.prePromptMessageCount;
 	};
 	const applyActiveContextEngineProjection = async (decisionStartupBinding) => {
@@ -8036,10 +8129,7 @@ async function runCodexAppServerAttempt(params, options = {}) {
 			originalHistoryMessages: historyMessages,
 			prompt: params.prompt,
 			systemPromptAddition: assembled.systemPromptAddition,
-			maxRenderedContextChars: resolveCodexContextEngineProjectionMaxChars({
-				contextTokenBudget: params.contextTokenBudget,
-				reserveTokens: resolveCodexContextEngineProjectionReserveTokens({ config: params.config })
-			}),
+			maxRenderedContextChars: codexContextProjectionMaxChars,
 			toolPayloadMode: contextEngineProjection ? "preserve" : "elide"
 		});
 		const projectionDecision = contextEngineProjection ? resolveContextEngineBootstrapProjectionDecision({
@@ -8069,6 +8159,7 @@ async function runCodexAppServerAttempt(params, options = {}) {
 			developerInstructionAdditionChars: projection.developerInstructionAddition?.length ?? 0
 		});
 		promptText = projectionDecision.project ? projection.promptText : params.prompt;
+		promptContextRange = projectionDecision.project ? projection.promptContextRange : void 0;
 		developerInstructions = joinPresentSections(baseDeveloperInstructions, projection.developerInstructionAddition);
 		prePromptMessageCount = projection.prePromptMessageCount;
 	};
@@ -8082,11 +8173,52 @@ async function runCodexAppServerAttempt(params, options = {}) {
 		prompt: prependCurrentInboundContext(promptText, params.currentInboundContext),
 		developerInstructions,
 		messages: codexModelInputHistoryMessages,
-		ctx: hookContext
+		ctx: hookContext,
+		..."beforeAgentStartResult" in params ? { beforeAgentStartResult: params.beforeAgentStartResult } : {}
 	});
+	const resolveShiftedPromptInputRange = (prompt, promptInputRange, turnPromptText) => {
+		if (!promptInputRange || promptInputRange.start < 0 || promptInputRange.end < promptInputRange.start || promptInputRange.end > prompt.length || !turnPromptText.endsWith(prompt)) return;
+		const turnPromptOffset = turnPromptText.length - prompt.length;
+		return {
+			start: turnPromptOffset + promptInputRange.start,
+			end: turnPromptOffset + promptInputRange.end
+		};
+	};
+	const resolveShiftedPromptContextRange = (prompt, promptInputRange, turnPromptText) => {
+		const promptTextInputOffset = promptInputRange ? promptInputRange.end - promptText.length : void 0;
+		if (!promptContextRange || !promptInputRange || promptTextInputOffset === void 0 || promptInputRange.start < 0 || promptInputRange.end < promptInputRange.start || promptInputRange.end > prompt.length || promptTextInputOffset < promptInputRange.start || prompt.slice(promptTextInputOffset, promptInputRange.end) !== promptText || !turnPromptText.endsWith(prompt)) return;
+		const promptTextOffset = prompt.endsWith(promptText) ? prompt.length - promptText.length : promptTextInputOffset;
+		if (promptTextOffset < 0) return;
+		const turnPromptOffset = turnPromptText.length - prompt.length + promptTextOffset;
+		const contextRange = {
+			start: turnPromptOffset + promptContextRange.start,
+			end: turnPromptOffset + promptContextRange.end
+		};
+		return {
+			contextRange,
+			requestRange: {
+				start: contextRange.end,
+				end: turnPromptOffset + promptText.length
+			}
+		};
+	};
 	let promptBuild = await buildPromptFromCurrentInputs();
-	const decorateCodexTurnPromptText = (prompt) => prependCodexOpenClawPromptContext(prompt, openClawPromptContext, { preservePromptWithoutContext: params.bootstrapContextMode === "lightweight" && params.bootstrapContextRunKind === "cron" });
-	let codexTurnPromptText = decorateCodexTurnPromptText(promptBuild.prompt);
+	const decorateCodexTurnPromptText = (promptBuildResult) => {
+		const turnPromptText = prependCodexOpenClawPromptContext(promptBuildResult.prompt, openClawPromptContext, { preservePromptWithoutContext: params.bootstrapContextMode === "lightweight" && params.bootstrapContextRunKind === "cron" });
+		const projectedRanges = resolveShiftedPromptContextRange(promptBuildResult.prompt, promptBuildResult.promptInputRange, turnPromptText);
+		const preservedRange = resolveShiftedPromptInputRange(promptBuildResult.prompt, promptBuildResult.promptInputRange, turnPromptText) ?? resolveCodexDeliveryHintPreservedInputRange({
+			prompt: promptBuildResult.prompt,
+			promptInputRange: promptBuildResult.promptInputRange,
+			decoratedPrompt: turnPromptText
+		});
+		return fitCodexProjectedContextForTurnStart({
+			promptText: turnPromptText,
+			contextRange: projectedRanges?.contextRange,
+			requestRange: projectedRanges?.requestRange,
+			preservedRange
+		});
+	};
+	let codexTurnPromptText = decorateCodexTurnPromptText(promptBuild);
 	const buildCodexTurnCollaborationDeveloperInstructions = () => buildTurnCollaborationMode(params, {
 		turnScopedDeveloperInstructions: workspaceBootstrapContext.turnScopedDeveloperInstructions,
 		skillsCollaborationInstructions,
@@ -8096,15 +8228,16 @@ async function runCodexAppServerAttempt(params, options = {}) {
 	const buildRenderedCodexDeveloperInstructions = () => joinPresentSections(promptBuild.developerInstructions, buildCodexTurnCollaborationDeveloperInstructions());
 	const rebuildCodexPromptBuildFromCurrentProjection = async () => {
 		promptBuild = await buildPromptFromCurrentInputs();
-		codexTurnPromptText = decorateCodexTurnPromptText(promptBuild.prompt);
+		codexTurnPromptText = decorateCodexTurnPromptText(promptBuild);
 	};
 	const rebuildCodexTurnPromptTextFromCurrentProjection = async () => {
 		const nextPromptBuild = await buildPromptFromCurrentInputs();
 		promptBuild = {
 			...promptBuild,
-			prompt: nextPromptBuild.prompt
+			prompt: nextPromptBuild.prompt,
+			promptInputRange: nextPromptBuild.promptInputRange
 		};
-		codexTurnPromptText = decorateCodexTurnPromptText(nextPromptBuild.prompt);
+		codexTurnPromptText = decorateCodexTurnPromptText(nextPromptBuild);
 	};
 	const selectNewerVisibleHistoryAfterBinding = (binding) => {
 		const bindingUpdatedAt = Date.parse(binding.updatedAt);
@@ -8127,9 +8260,11 @@ async function runCodexAppServerAttempt(params, options = {}) {
 		const projection = projectContextEngineAssemblyForCodex({
 			assembledMessages: newerVisibleMessages,
 			originalHistoryMessages: historyMessages,
-			prompt: params.prompt
+			prompt: params.prompt,
+			maxRenderedContextChars: codexContextProjectionMaxChars
 		});
 		promptText = projection.promptText;
+		promptContextRange = projection.promptContextRange;
 		prePromptMessageCount = projection.prePromptMessageCount;
 		return true;
 	};
@@ -8178,6 +8313,7 @@ async function runCodexAppServerAttempt(params, options = {}) {
 		if (startupBinding?.threadId) return;
 		inactiveThreadBootstrapBindingForcedFreshStart = hadInactiveThreadBootstrapBinding;
 		staleBindingContinuityForcedFreshStart = precomputedStaleBindingContinuityProjectionApplied && !inactiveThreadBootstrapBindingForcedFreshStart;
+		if (staleBindingContinuityForcedFreshStart) applyFreshThreadContinuityProjection();
 		if (activeContextEngine) {
 			contextEngineProjection = void 0;
 			try {

package/dist/{session-binding-BRUi8y6E.js → session-binding-HOuPt-E0.js}

@@ -1,5 +1,5 @@
 import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
-import { l as normalizeCodexServiceTier } from "./config-BksX0T33.js";
+import { l as normalizeCodexServiceTier } from "./config-CszD0vP3.js";
 import fs from "node:fs/promises";
 import { ensureAuthProfileStore, resolveDefaultAgentDir, resolveProviderIdForAuth } from "openclaw/plugin-sdk/agent-runtime";
 import { embeddedAgentLog } from "openclaw/plugin-sdk/agent-harness-runtime";

package/dist/{shared-client-Bg5d7VV9.js → shared-client-Dtx5i7Ez.js}

@@ -1,6 +1,6 @@
 import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
-import { d as resolveCodexAppServerRuntimeOptions, r as codexAppServerStartOptionsKey } from "./config-BksX0T33.js";
-import { c as resolveCodexAppServerSpawnEnv, o as MANAGED_CODEX_APP_SERVER_PACKAGE, t as CodexAppServerClient } from "./client-m7XiCQpO.js";
+import { d as resolveCodexAppServerRuntimeOptions, r as codexAppServerStartOptionsKey } from "./config-CszD0vP3.js";
+import { c as resolveCodexAppServerSpawnEnv, o as MANAGED_CODEX_APP_SERVER_PACKAGE, t as CodexAppServerClient } from "./client-CLrtWgrD.js";
 import { createRequire } from "node:module";
 import fs, { access } from "node:fs/promises";
 import path from "node:path";

package/dist/{side-question-BdYL4kj1.js → side-question-BO7GbMFO.js}

@@ -1,14 +1,14 @@
 import { n as isJsonObject } from "./protocol-dh-ETiNd.js";
-import { B as readCodexNotificationThreadId, M as mergeCodexThreadConfigs, S as filterCodexDynamicTools, T as resolveCodexDynamicToolsLoading, V as readCodexNotificationTurnId, _ as resolveCodexWebSearchPlan, d as resolveCodexAppServerRequestModelSelection, m as resolveReasoningEffort, p as resolveCodexBindingModelProviderFallback, r as buildCodexRuntimeThreadConfig, t as CODEX_NATIVE_PERSONALITY_NONE, u as resolveCodexAppServerModelProvider } from "./thread-lifecycle-CbJqqnEw.js";
-import { d as resolveCodexAppServerRuntimeOptions, g as shouldAutoApproveCodexAppServerApprovals, h as resolveOpenClawExecPolicyForCodexAppServer, n as canUseCodexModelBackedApprovalsReviewerForModel, p as resolveCodexModelBackedReviewerPolicyContext, u as readCodexPluginConfig } from "./config-BksX0T33.js";
+import { H as readCodexNotificationTurnId, N as mergeCodexThreadConfigs, S as filterCodexDynamicTools, T as resolveCodexDynamicToolsLoading, V as readCodexNotificationThreadId, _ as resolveCodexWebSearchPlan, d as resolveCodexAppServerRequestModelSelection, m as resolveReasoningEffort, p as resolveCodexBindingModelProviderFallback, r as buildCodexRuntimeThreadConfig, t as CODEX_NATIVE_PERSONALITY_NONE, u as resolveCodexAppServerModelProvider } from "./thread-lifecycle-CJdHuthD.js";
+import { d as resolveCodexAppServerRuntimeOptions, g as shouldAutoApproveCodexAppServerApprovals, h as resolveOpenClawExecPolicyForCodexAppServer, n as canUseCodexModelBackedApprovalsReviewerForModel, p as resolveCodexModelBackedReviewerPolicyContext, u as readCodexPluginConfig } from "./config-CszD0vP3.js";
 import { a as readCodexDynamicToolCallParams, c as readCodexTurn, i as assertCodexTurnStartResponse, t as assertCodexThreadForkResponse } from "./protocol-validators-B19q5BIX.js";
-import { i as formatCodexUsageLimitErrorMessage } from "./provider-qJygHQx4.js";
-import { i as isCodexAppServerApprovalRequest } from "./client-m7XiCQpO.js";
-import { i as isCodexAppServerNativeAuthProfile, o as readCodexAppServerBinding } from "./session-binding-BRUi8y6E.js";
-import { t as resolveCodexAppServerForModelProvider } from "./app-server-policy-KpyUye2D.js";
-import { a as getLeasedSharedCodexAppServerClient, o as releaseLeasedSharedCodexAppServerClient, u as refreshCodexAppServerAuthTokens } from "./shared-client-Bg5d7VV9.js";
+import { i as formatCodexUsageLimitErrorMessage } from "./provider-B-OHpbD3.js";
+import { i as isCodexAppServerApprovalRequest } from "./client-CLrtWgrD.js";
+import { i as isCodexAppServerNativeAuthProfile, o as readCodexAppServerBinding } from "./session-binding-HOuPt-E0.js";
+import { t as resolveCodexAppServerForModelProvider } from "./app-server-policy-BPTiVNsW.js";
+import { a as getLeasedSharedCodexAppServerClient, o as releaseLeasedSharedCodexAppServerClient, u as refreshCodexAppServerAuthTokens } from "./shared-client-Dtx5i7Ez.js";
 import { n as resolveCodexNativeExecutionBlock } from "./sandbox-guard-3tnjhjFb.js";
-import { C as resolveCodexMessageToolProvider, O as filterToolsForVisionInputs, T as shouldEnableCodexAppServerNativeToolSurface, a as buildCodexNativeHookRelayConfig, d as handleCodexAppServerElicitationRequest, f as createCodexDynamicToolBridge, h as emitDynamicToolTerminalDiagnostic, k as handleCodexAppServerApprovalRequest, m as emitDynamicToolStartedDiagnostic, n as resolveCodexProviderWebSearchSupportForClient, o as buildCodexNativeHookRelayDisabledConfig, p as emitDynamicToolErrorDiagnostic, r as CODEX_NATIVE_HOOK_RELAY_EVENTS } from "./provider-capabilities-BOvTfMhF.js";
+import { C as resolveCodexMessageToolProvider, O as filterToolsForVisionInputs, T as shouldEnableCodexAppServerNativeToolSurface, a as buildCodexNativeHookRelayConfig, d as handleCodexAppServerElicitationRequest, f as createCodexDynamicToolBridge, h as emitDynamicToolTerminalDiagnostic, k as handleCodexAppServerApprovalRequest, m as emitDynamicToolStartedDiagnostic, n as resolveCodexProviderWebSearchSupportForClient, o as buildCodexNativeHookRelayDisabledConfig, p as emitDynamicToolErrorDiagnostic, r as CODEX_NATIVE_HOOK_RELAY_EVENTS } from "./provider-capabilities-D2Ee9YEI.js";
 import { n as rememberCodexRateLimits, t as readRecentCodexRateLimits } from "./rate-limit-cache-C7qmZ0Jh.js";
 import { loadExecApprovals } from "openclaw/plugin-sdk/exec-approvals-runtime";
 import { buildAgentHookContextChannelFields, embeddedAgentLog, formatErrorMessage, registerNativeHookRelay, resolveAgentDir, resolveAttemptSpawnWorkspaceDir, resolveModelAuthMode, resolveSandboxContext, resolveSessionAgentIds, supportsModelTools } from "openclaw/plugin-sdk/agent-harness-runtime";

package/dist/{thread-lifecycle-CbJqqnEw.js → thread-lifecycle-CJdHuthD.js}

@@ -1,10 +1,10 @@
 import { n as isJsonObject, t as flattenCodexDynamicToolFunctions } from "./protocol-dh-ETiNd.js";
-import { i as codexSandboxPolicyForTurn, m as resolveCodexPluginsPolicy, t as CODEX_PLUGINS_MARKETPLACE_NAME } from "./config-BksX0T33.js";
+import { i as codexSandboxPolicyForTurn, m as resolveCodexPluginsPolicy, t as CODEX_PLUGINS_MARKETPLACE_NAME } from "./config-CszD0vP3.js";
 import { n as assertCodexThreadResumeResponse, r as assertCodexThreadStartResponse } from "./protocol-validators-B19q5BIX.js";
 import { CODEX_GPT5_HEARTBEAT_PROMPT_OVERLAY } from "./prompt-overlay.js";
-import { r as isModernCodexModel } from "./provider-qJygHQx4.js";
-import { a as isCodexAppServerConnectionClosedError, n as CodexAppServerRpcError } from "./client-m7XiCQpO.js";
-import { i as isCodexAppServerNativeAuthProfile, l as writeCodexAppServerBinding, n as clearCodexAppServerBinding, o as readCodexAppServerBinding } from "./session-binding-BRUi8y6E.js";
+import { r as isModernCodexModel } from "./provider-B-OHpbD3.js";
+import { a as isCodexAppServerConnectionClosedError, n as CodexAppServerRpcError } from "./client-CLrtWgrD.js";
+import { i as isCodexAppServerNativeAuthProfile, l as writeCodexAppServerBinding, n as clearCodexAppServerBinding, o as readCodexAppServerBinding } from "./session-binding-HOuPt-E0.js";
 import "node:fs/promises";
 import "node:path";
 import { isFutureDateTimestampMs, resolveDateTimestampMs, resolveExpiresAtMsFromDurationMs } from "openclaw/plugin-sdk/number-runtime";
@@ -860,6 +860,7 @@ const MAX_RENDERED_CONTEXT_CHARS = 1e6;
 const DEFAULT_TEXT_PART_CHARS = 6e3;
 const MAX_TEXT_PART_CHARS = 128e3;
 const APPROX_RENDERED_CHARS_PER_TOKEN = 4;
+const CODEX_TURN_START_TEXT_INPUT_MAX_CHARS = 1 << 20;
 /** Default token reserve kept out of rendered context-engine prompt text. */
 const DEFAULT_CODEX_PROJECTION_RESERVE_TOKENS = 2e4;
 const MIN_PROMPT_BUDGET_RATIO = .5;
@@ -873,20 +874,23 @@ function projectContextEngineAssemblyForCodex(params) {
 		maxTextPartChars: resolveTextPartMaxChars(maxRenderedContextChars),
 		toolPayloadMode: params.toolPayloadMode ?? "elide"
 	});
-	const promptText = renderedContext ? [
+	const boundedContext = renderedContext ? truncateOlderContext(renderedContext, maxRenderedContextChars) : void 0;
+	const promptPrefix = boundedContext ? [
 		CONTEXT_HEADER,
 		CONTEXT_SAFETY_NOTE,
 		"",
-		CONTEXT_OPEN,
-		truncateOlderContext(renderedContext, maxRenderedContextChars),
-		CONTEXT_CLOSE,
-		"",
-		REQUEST_HEADER,
-		prompt
-	].join("\n") : prompt;
+		CONTEXT_OPEN
+	].join("\n") + "\n" : void 0;
+	const promptSuffix = boundedContext ? `\n${CONTEXT_CLOSE}\n\n${REQUEST_HEADER}\n${prompt}` : "";
+	const promptText = boundedContext ? `${promptPrefix}${boundedContext}${promptSuffix}` : prompt;
+	const promptContextRange = promptPrefix && boundedContext ? {
+		start: promptPrefix.length,
+		end: promptPrefix.length + boundedContext.length
+	} : void 0;
 	return {
 		...params.systemPromptAddition?.trim() ? { developerInstructionAddition: params.systemPromptAddition.trim() } : {},
 		promptText,
+		...promptContextRange ? { promptContextRange } : {},
 		assembledMessages: params.assembledMessages,
 		prePromptMessageCount: params.originalHistoryMessages.length
 	};
@@ -908,6 +912,46 @@ function resolveCodexContextEngineProjectionReserveTokens(params) {
 	if (configuredReserveTokens !== void 0) return Math.max(configuredReserveTokens, configuredReserveTokensFloor ?? 2e4);
 	if (configuredReserveTokensFloor !== void 0) return configuredReserveTokensFloor;
 }
+/** Fits projected context prompts under Codex app-server turn/start text limits. */
+function fitCodexProjectedContextForTurnStart(params) {
+	const maxChars = typeof params.maxChars === "number" && Number.isFinite(params.maxChars) ? Math.max(0, Math.floor(params.maxChars)) : CODEX_TURN_START_TEXT_INPUT_MAX_CHARS;
+	if (params.promptText.length <= maxChars) return params.promptText;
+	const range = normalizeProjectedContextRange(params.contextRange, params.promptText.length);
+	if (!range) {
+		const preservedRange = normalizeProjectedContextRange(params.preservedRange, params.promptText.length);
+		if (!preservedRange) return params.promptText;
+		const preservedText = params.promptText.slice(preservedRange.start, preservedRange.end);
+		if (!preservedText) return truncateOlderContext(params.promptText, maxChars);
+		if (preservedText.length >= maxChars) return truncateOlderContext(preservedText, maxChars);
+		return `${truncateOlderContext(params.promptText.slice(0, preservedRange.start), maxChars - preservedText.length)}${preservedText}`;
+	}
+	const beforeContext = params.promptText.slice(0, range.start);
+	const context = params.promptText.slice(range.start, range.end);
+	const afterContext = params.promptText.slice(range.end);
+	const requestRange = normalizeProjectedContextRange(params.requestRange, params.promptText.length);
+	if (requestRange && requestRange.start >= range.end && requestRange.end < params.promptText.length) {
+		const request = params.promptText.slice(requestRange.start, requestRange.end);
+		if (request.length >= maxChars) return truncateOlderContext(request, maxChars);
+		const fittedAppendedContext = truncateOlderContext(params.promptText.slice(requestRange.end), maxChars - request.length);
+		const fittedContext = truncateOlderContext(context, maxChars - request.length - fittedAppendedContext.length);
+		return `${truncateOlderContext(beforeContext, maxChars - fittedContext.length - request.length - fittedAppendedContext.length)}${fittedContext}${request}${fittedAppendedContext}`;
+	}
+	const contextBudget = maxChars - beforeContext.length - afterContext.length;
+	if (contextBudget > 0) return `${beforeContext}${truncateOlderContext(context, contextBudget)}${afterContext}`;
+	const afterContextText = truncateOlderContext(afterContext, maxChars);
+	return `${truncateOlderContext(context, maxChars - afterContextText.length)}${afterContextText}`;
+}
+function normalizeProjectedContextRange(range, textLength) {
+	if (!range) return;
+	const start = Math.floor(range.start);
+	const end = Math.floor(range.end);
+	if (!Number.isFinite(start) || !Number.isFinite(end) || start < 0 || end < start) return;
+	if (end > textLength) return;
+	return {
+		start,
+		end
+	};
+}
 function resolveProjectionPromptBudgetTokens(params) {
 	const requestedReserveTokens = typeof params.reserveTokens === "number" && Number.isFinite(params.reserveTokens) && params.reserveTokens >= 0 ? Math.floor(params.reserveTokens) : DEFAULT_CODEX_PROJECTION_RESERVE_TOKENS;
 	const minPromptBudget = Math.min(MIN_PROMPT_BUDGET_TOKENS, Math.max(1, Math.floor(params.contextTokenBudget * MIN_PROMPT_BUDGET_RATIO)));
@@ -1059,7 +1103,15 @@ function truncateOlderContext(text, maxChars) {
 	marker = buildMarker(text.length - tailChars);
 	if (marker.length >= maxChars) return marker.slice(0, maxChars);
 	tailChars = maxChars - marker.length;
-	return `${marker}${text.slice(text.length - tailChars).trimStart()}`;
+	return `${marker}${sliceTailFromCodePointBoundary(text, tailChars).trimStart()}`;
+}
+function sliceTailFromCodePointBoundary(text, tailChars) {
+	let start = text.length - tailChars;
+	if (start > 0 && start < text.length) {
+		const code = text.charCodeAt(start);
+		if (code >= 56320 && code <= 57343) start += 1;
+	}
+	return text.slice(start);
 }
 //#endregion
 //#region extensions/codex/src/app-server/dynamic-tool-profile.ts
@@ -2213,4 +2265,4 @@ function resolveReasoningEffort(thinkLevel, modelId) {
 	return null;
 }
 //#endregion
-export { buildCodexPluginThreadConfig as A, readCodexNotificationThreadId as B, isForcedPrivateQaCodexRuntime as C, projectContextEngineAssemblyForCodex as D, resolveCodexDynamicToolsLoadingForRuntime as E, pluginReadParams as F, buildCodexAppInventoryCacheKey as I, defaultCodexAppInventoryCache as L, mergeCodexThreadConfigs as M, shouldBuildCodexPluginThreadConfig as N, resolveCodexContextEngineProjectionMaxChars as O, ensureCodexPluginActivation as P, describeCodexNotificationCorrelation as R, filterCodexDynamicTools as S, resolveCodexDynamicToolsLoading as T, readCodexNotificationTurnId as V, resolveCodexWebSearchPlan as _, buildDeveloperInstructions as a, sanitizeCodexHistoryImagePayloads as b, codexDynamicToolsFingerprint as c, resolveCodexAppServerRequestModelSelection as d, resolveCodexAppServerThreadModelSelection as f, buildCodexNativeWebSearchThreadConfig as g, startOrResumeThread as h, buildContextEngineBinding as i, buildCodexPluginThreadConfigInputFingerprint as j, resolveCodexContextEngineProjectionReserveTokens as k, isContextEngineBindingCompatible as l, resolveReasoningEffort as m, areCodexDynamicToolFingerprintsCompatible as n, buildTurnCollaborationMode as o, resolveCodexBindingModelProviderFallback as p, buildCodexRuntimeThreadConfig as r, buildTurnStartParams as s, CODEX_NATIVE_PERSONALITY_NONE as t, resolveCodexAppServerModelProvider as u, isCodexAppServerProfilerEnabled as v, normalizeCodexDynamicToolName as w, sanitizeInlineImageDataUrl$1 as x, invalidInlineImageText as y, isCodexNotificationForTurn as z };
+export { resolveCodexContextEngineProjectionReserveTokens as A, isCodexNotificationForTurn as B, isForcedPrivateQaCodexRuntime as C, fitCodexProjectedContextForTurnStart as D, resolveCodexDynamicToolsLoadingForRuntime as E, ensureCodexPluginActivation as F, readCodexNotificationTurnId as H, pluginReadParams as I, buildCodexAppInventoryCacheKey as L, buildCodexPluginThreadConfigInputFingerprint as M, mergeCodexThreadConfigs as N, projectContextEngineAssemblyForCodex as O, shouldBuildCodexPluginThreadConfig as P, defaultCodexAppInventoryCache as R, filterCodexDynamicTools as S, resolveCodexDynamicToolsLoading as T, readCodexNotificationThreadId as V, resolveCodexWebSearchPlan as _, buildDeveloperInstructions as a, sanitizeCodexHistoryImagePayloads as b, codexDynamicToolsFingerprint as c, resolveCodexAppServerRequestModelSelection as d, resolveCodexAppServerThreadModelSelection as f, buildCodexNativeWebSearchThreadConfig as g, startOrResumeThread as h, buildContextEngineBinding as i, buildCodexPluginThreadConfig as j, resolveCodexContextEngineProjectionMaxChars as k, isContextEngineBindingCompatible as l, resolveReasoningEffort as m, areCodexDynamicToolFingerprintsCompatible as n, buildTurnCollaborationMode as o, resolveCodexBindingModelProviderFallback as p, buildCodexRuntimeThreadConfig as r, buildTurnStartParams as s, CODEX_NATIVE_PERSONALITY_NONE as t, resolveCodexAppServerModelProvider as u, isCodexAppServerProfilerEnabled as v, normalizeCodexDynamicToolName as w, sanitizeInlineImageDataUrl$1 as x, invalidInlineImageText as y, describeCodexNotificationCorrelation as z };

package/dist/{web-search-provider.runtime-DrpQ8Cyd.js → web-search-provider.runtime-CMEYazjn.js}

@@ -1,6 +1,6 @@
 import { n as isJsonObject } from "./protocol-dh-ETiNd.js";
-import { g as buildCodexNativeWebSearchThreadConfig } from "./thread-lifecycle-CbJqqnEw.js";
-import { n as runBoundedCodexAppServerTurn } from "./media-understanding-provider-CiwPkR58.js";
+import { g as buildCodexNativeWebSearchThreadConfig } from "./thread-lifecycle-CJdHuthD.js";
+import { n as runBoundedCodexAppServerTurn } from "./media-understanding-provider-DSQ2ry-4.js";
 import { readStringParam, resolveSearchTimeoutSeconds, wrapWebContent } from "openclaw/plugin-sdk/provider-web-search";
 //#region extensions/codex/src/web-search-provider.runtime.ts
 async function executeCodexWebSearchProviderTool(ctx, args, executionContext, options) {

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "@openclaw/codex",
-  "version": "2026.6.9-beta.1",
+  "version": "2026.6.10-beta.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@openclaw/codex",
-      "version": "2026.6.9-beta.1",
+      "version": "2026.6.10-beta.1",
       "dependencies": {
         "@openai/codex": "0.139.0",
         "typebox": "1.1.39",

package/openclaw.plugin.json

@@ -152,10 +152,10 @@
             ]
           },
           "url": { "type": "string" },
-          "authToken": { "type": "string" },
+          "authToken": { "type": ["string", "object"] },
           "headers": {
             "type": "object",
-            "additionalProperties": { "type": "string" }
+            "additionalProperties": { "type": ["string", "object"] }
           },
           "clearEnv": {
             "type": "array",
@@ -254,6 +254,14 @@
       }
     }
   },
+  "configContracts": {
+    "secretInputs": {
+      "paths": [
+        { "path": "appServer.authToken", "expected": "string" },
+        { "path": "appServer.headers.*", "expected": "string" }
+      ]
+    }
+  },
   "uiHints": {
     "codexDynamicToolsLoading": {
       "label": "Dynamic Tools Loading",
@@ -382,6 +390,7 @@
     "appServer.headers": {
       "label": "Headers",
       "help": "Additional headers sent to the WebSocket app-server.",
+      "sensitive": true,
       "advanced": true
     },
     "appServer.clearEnv": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openclaw/codex",
-  "version": "2026.6.9-beta.1",
+  "version": "2026.6.10-beta.1",
   "description": "OpenClaw Codex app-server harness and model provider plugin with a Codex-managed GPT catalog.",
   "repository": {
     "type": "git",
@@ -34,10 +34,10 @@
       ]
     },
     "compat": {
-      "pluginApi": ">=2026.6.9-beta.1"
+      "pluginApi": ">=2026.6.10-beta.1"
     },
     "build": {
-      "openclawVersion": "2026.6.9-beta.1"
+      "openclawVersion": "2026.6.10-beta.1"
     },
     "release": {
       "publishToClawHub": true,
@@ -55,7 +55,7 @@
     "README.md"
   ],
   "peerDependencies": {
-    "openclaw": ">=2026.6.9-beta.1"
+    "openclaw": ">=2026.6.10-beta.1"
   },
   "peerDependenciesMeta": {
     "openclaw": {