@openclaw/codex 2026.7.1 → 2026.7.2-beta.2

package/dist/{command-handlers-Dv-pzAmg.js → command-handlers-IgqmL_kv.js}

@@ -1,27 +1,31 @@
-import { r as isJsonObject } from "./protocol-2POPqAY4.js";
-import { o as isCodexFastServiceTier } from "./config-CYEDnLJ2.js";
-import { n as assertCodexThreadResumeResponse } from "./protocol-validators-dZQ-UTOa.js";
-import { t as listAllCodexAppServerModels } from "./models-DDmO1zwd.js";
-import { p as summarizeCodexAccountUsage } from "./provider-zjPfx5Fs.js";
-import { y as resolveCodexAppServerAuthProfileIdForAgent } from "./shared-client-4ICy3U6d.js";
-import { a as normalizeCodexAppServerBindingModelProvider, n as bindingStoreKey, o as reclaimCurrentCodexSessionGeneration, s as sessionBindingIdentity } from "./session-binding-C1ZXdP-x.js";
-import { r as CODEX_CONTROL_METHODS } from "./plugin-app-cache-key-BrhVdeEf.js";
-import { a as formatCodexDisplayText, c as formatList, d as formatThreads, f as readString$1, i as formatAccount, l as formatModels, o as formatCodexStatus, r as buildHelp, s as formatComputerUseStatus, u as formatSkills } from "./app-server-policy-C968Kgin.js";
-import { n as resolveCodexNativeExecutionBlock, r as resolveCodexNativeSandboxBlock } from "./sandbox-guard-DA2TQfZW.js";
-import { S as canMutateCodexHost, _ as setCodexConversationPermissions, d as formatPermissionsMode, f as parseCodexFastModeArg, g as setCodexConversationModel, h as setCodexConversationFastMode, i as safeCodexControlRequest, m as readCodexConversationActiveTurn, n as readCodexStatusProbes, p as parseCodexPermissionsModeArg, r as requestOptions, s as formatCodexCliSessions, t as codexControlRequest, v as steerCodexConversationTurn, x as CODEX_NATIVE_EXECUTION_AUTH_ERROR, y as stopCodexConversationTurn } from "./command-rpc-eLM_mtC7.js";
+import { S as resolveCodexAppServerAuthProfileIdForAgent, Z as isJsonObject } from "./shared-client-JiAnW6pc.js";
+import { _ as isCodexFastServiceTier, c as sessionBindingIdentity, n as assertCodexBindingMayBeReplaced, o as normalizeCodexAppServerBindingModelProvider, r as bindingStoreKey, s as reclaimCurrentCodexSessionGeneration } from "./session-binding-h1mmCGnl.js";
+import { u as assertCodexThreadResumeResponse } from "./transcript-mirror-D9rTxx2P.js";
+import { t as listAllCodexAppServerModels } from "./models-uh26C8QU.js";
+import { a as formatComputerUseStatus, c as formatSkills, d as CODEX_CONTROL_METHODS, i as formatCodexStatus, l as formatThreads, n as formatAccount, o as formatList, r as formatCodexDisplayText, s as formatModels, t as buildHelp, u as readString$1 } from "./command-formatters-Dq9InZUK.js";
+import { s as summarizeCodexAccountUsage } from "./rate-limits-DyXaYAxU.js";
+import { n as resolveCodexNativeExecutionBlock, r as resolveCodexNativeSandboxBlock } from "./sandbox-guard-D1Wky__S.js";
+import { a as setCodexConversationFastMode, c as steerCodexConversationTurn, d as CODEX_NATIVE_EXECUTION_AUTH_ERROR, f as canMutateCodexHost, i as readCodexConversationActiveTurn, l as stopCodexConversationTurn, n as parseCodexFastModeArg, o as setCodexConversationModel, r as parseCodexPermissionsModeArg, s as setCodexConversationPermissions, t as formatPermissionsMode } from "./conversation-control-CGkBlfc5.js";
 import { i as readCodexConversationBindingData, n as createCodexCliNodeConversationBindingData, o as resolveCodexDefaultWorkspaceDir, r as createCodexConversationBindingData } from "./conversation-binding-data-BHRpYbX3.js";
-import { n as installCodexComputerUse, r as readCodexComputerUseStatus } from "./computer-use-Bmaz333N.js";
+import { a as resolveCodexBindingAppServerConnection } from "./notification-correlation-KmfV4EkP.js";
+import { c as requestOptions, l as safeCodexControlRequest, o as codexControlRequest, p as formatCodexCliSessions, s as readCodexStatusProbes } from "./session-catalog-CEvoXWHA.js";
+import { i as readCodexComputerUseStatus, n as installCodexComputerUse } from "./computer-use-CPcU8TjG.js";
 import { parseStrictPositiveInteger } from "openclaw/plugin-sdk/number-runtime";
+import { truncateUtf16Safe } from "openclaw/plugin-sdk/text-utility-runtime";
 import crypto from "node:crypto";
-import { ensureAuthProfileStore, findNormalizedProviderValue, resolveAgentDir, resolveAuthProfileEligibility, resolveAuthProfileOrder, resolveDefaultAgentDir, resolveProfileUnusableUntilForDisplay, resolveSessionAgentIds } from "openclaw/plugin-sdk/agent-runtime";
+import { ensureAuthProfileStore, findNormalizedProviderValue, resolveAgentDir, resolveAuthProfileEligibility, resolveAuthProfileOrder, resolveProfileUnusableUntilForDisplay, resolveSessionAgentIds } from "openclaw/plugin-sdk/agent-runtime";
 import { parseAgentSessionKey } from "openclaw/plugin-sdk/routing";
 import { normalizeOptionalString, normalizeUniqueStringEntries } from "openclaw/plugin-sdk/string-coerce-runtime";
+import { getSessionEntry, resolveStorePath } from "openclaw/plugin-sdk/session-store-runtime";
+import { expectDefined } from "openclaw/plugin-sdk/expect-runtime";
+import { MODEL_SELECTION_LOCKED_MESSAGE, isModelSelectionLocked } from "openclaw/plugin-sdk/model-session-runtime";
 //#region extensions/codex/src/command-account.ts
 const OPENAI_PROVIDER_ID = "openai";
 const OPENAI_CODEX_PROVIDER_ID = OPENAI_PROVIDER_ID;
 async function readCodexAccountAuthOverview(params) {
 	const config = params.ctx.config;
-	const store = ensureAuthProfileStore(resolveDefaultAgentDir(config), {
+	const agentDir = params.agentDir;
+	const store = ensureAuthProfileStore(agentDir, {
 		allowKeychainPrompt: false,
 		config
 	});
@@ -45,6 +49,7 @@ async function readCodexAccountAuthOverview(params) {
 	const activeUsage = activeIsSubscription && params.limits.ok ? summarizeCodexAccountUsage(params.limits.value, now) : void 0;
 	const subscriptionUsage = subscriptionProfileId && (!activeIsSubscription || subscriptionProfileId !== activeProfileId) ? await readSubscriptionUsage({
 		...params,
+		agentDir,
 		config,
 		subscriptionProfileId,
 		now
@@ -149,7 +154,7 @@ function resolveLiveAccountProfileId(params) {
 		if (!email) return firstSubscription;
 		return params.order.find((profileId) => {
 			const credential = params.store.profiles[profileId];
-			if (!isChatGptSubscriptionProfile(credential)) return false;
+			if (!credential || !isChatGptSubscriptionProfile(credential)) return false;
 			return (credential.email?.trim().toLowerCase() ?? extractEmailFromProfileId(profileId))?.toLowerCase() === email;
 		}) ?? firstSubscription;
 	}
@@ -161,6 +166,7 @@ function shouldInferApiKeyActiveFromRateLimitProbe(limits) {
 async function readSubscriptionUsage(params) {
 	const limits = await params.safeCodexControlRequest(params.pluginConfig, CODEX_CONTROL_METHODS.rateLimits, void 0, {
 		config: params.config,
+		agentDir: params.agentDir,
 		authProfileId: params.subscriptionProfileId,
 		isolated: true
 	});
@@ -308,6 +314,21 @@ function formatRelativeReset(untilMs, nowMs) {
 	return `in ${days} ${days === 1 ? "day" : "days"}`;
 }
 //#endregion
+//#region extensions/codex/src/command-diagnostics-state.ts
+/** Runtime state for diagnostics upload throttling and confirmation handshakes. */
+const codexDiagnosticsFeedbackState = {
+	lastUploadByThread: /* @__PURE__ */ new Map(),
+	lastUploadByScope: /* @__PURE__ */ new Map(),
+	pendingConfirmations: /* @__PURE__ */ new Map(),
+	pendingTokensByScope: /* @__PURE__ */ new Map(),
+	clear() {
+		this.lastUploadByThread.clear();
+		this.lastUploadByScope.clear();
+		this.pendingConfirmations.clear();
+		this.pendingTokensByScope.clear();
+	}
+};
+//#endregion
 //#region extensions/codex/src/command-presentation.ts
 function buildCodexCommandPickerPresentation(title, prompt, buttons) {
 	return {
@@ -526,10 +547,7 @@ const CODEX_NATIVE_CONTROL_SUBCOMMANDS = /* @__PURE__ */ new Set([
 	"unbind",
 	"stop"
 ]);
-const lastCodexDiagnosticsUploadByThread = /* @__PURE__ */ new Map();
-const lastCodexDiagnosticsUploadByScope = /* @__PURE__ */ new Map();
-const pendingCodexDiagnosticsConfirmations = /* @__PURE__ */ new Map();
-const pendingCodexDiagnosticsConfirmationTokensByScope = /* @__PURE__ */ new Map();
+const { lastUploadByThread: lastCodexDiagnosticsUploadByThread, lastUploadByScope: lastCodexDiagnosticsUploadByScope, pendingConfirmations: pendingCodexDiagnosticsConfirmations, pendingTokensByScope: pendingCodexDiagnosticsConfirmationTokensByScope } = codexDiagnosticsFeedbackState;
 /**
 * No-arg `/codex` picker. Codex owns the command tree; channels render the
 * portable command actions as inline controls when their transport can.
@@ -672,11 +690,13 @@ async function handleCodexSubcommand(ctx, options) {
 	}
 	if (normalized === "status") {
 		if (rest.length > 0) return { text: "Usage: /codex status" };
-		return { text: formatCodexStatus(await deps.readCodexStatusProbes(options.pluginConfig, ctx.config)) };
+		const { agentDir } = resolveCodexConversationControlScope(ctx);
+		return { text: formatCodexStatus(await deps.readCodexStatusProbes(options.pluginConfig, ctx.config, agentDir)) };
 	}
 	if (normalized === "models") {
 		if (rest.length > 0) return { text: "Usage: /codex models" };
-		return { text: formatModels(await deps.listCodexAppServerModels(deps.requestOptions(options.pluginConfig, 100, ctx.config))) };
+		const { agentDir } = resolveCodexConversationControlScope(ctx);
+		return { text: formatModels(await deps.listCodexAppServerModels(deps.requestOptions(options.pluginConfig, 100, ctx.config, agentDir))) };
 	}
 	if (normalized === "threads") return { text: await buildThreads(deps, ctx, options.pluginConfig, rest.join(" ")) };
 	if (normalized === "sessions") return { text: await buildCodexCliSessions(deps, rest) };
@@ -713,7 +733,7 @@ async function handleCodexSubcommand(ctx, options) {
 	}
 	if (normalized === "mcp") {
 		if (rest.length > 0) return { text: "Usage: /codex mcp" };
-		const scope = await resolveCommandAppServerScope(deps, ctx);
+		const scope = await resolveCommandAppServerScope(deps, ctx, options.pluginConfig);
 		return { text: formatList(await deps.codexControlRequest(options.pluginConfig, CODEX_CONTROL_METHODS.listMcpServers, { limit: 100 }, {
 			config: ctx.config,
 			...scope
@@ -721,7 +741,7 @@ async function handleCodexSubcommand(ctx, options) {
 	}
 	if (normalized === "skills") {
 		if (rest.length > 0) return { text: "Usage: /codex skills" };
-		const scope = await resolveCommandAppServerScope(deps, ctx);
+		const scope = await resolveCommandAppServerScope(deps, ctx, options.pluginConfig);
 		return { text: formatSkills(await deps.codexControlRequest(options.pluginConfig, CODEX_CONTROL_METHODS.listSkills, {}, {
 			config: ctx.config,
 			...scope
@@ -729,7 +749,7 @@ async function handleCodexSubcommand(ctx, options) {
 	}
 	if (normalized === "account") {
 		if (rest.length > 0) return { text: "Usage: /codex account" };
-		const scope = await resolveCommandAppServerScope(deps, ctx);
+		const scope = await resolveCommandAppServerScope(deps, ctx, options.pluginConfig);
 		const requestScope = {
 			config: ctx.config,
 			...scope
@@ -737,6 +757,7 @@ async function handleCodexSubcommand(ctx, options) {
 		const [account, limits] = await Promise.all([deps.safeCodexControlRequest(options.pluginConfig, CODEX_CONTROL_METHODS.account, { refreshToken: false }, requestScope), deps.safeCodexControlRequest(options.pluginConfig, CODEX_CONTROL_METHODS.rateLimits, void 0, requestScope)]);
 		return { text: formatAccount(account, limits, await readCodexAccountAuthOverview({
 			ctx,
+			agentDir: scope.agentDir,
 			pluginConfig: options.pluginConfig,
 			safeCodexControlRequest: deps.safeCodexControlRequest,
 			account,
@@ -745,6 +766,16 @@ async function handleCodexSubcommand(ctx, options) {
 	}
 	return { text: `Unknown Codex command: ${formatCodexDisplayText(subcommand)}\n\n${buildHelp()}` };
 }
+function isCurrentSessionModelSelectionLocked(ctx) {
+	const sessionKey = ctx.sessionKey?.trim();
+	if (!sessionKey) return false;
+	return isModelSelectionLocked(getSessionEntry({
+		storePath: resolveStorePath(ctx.config.session?.store, { agentId: ctx.agentId }),
+		sessionKey,
+		hydrateSkillPromptRefs: false,
+		readConsistency: "latest"
+	}));
+}
 function resolveCodexNativeCommandSandboxBlock(ctx, subcommand, args) {
 	if (!CODEX_NATIVE_EXECUTION_SUBCOMMANDS.has(subcommand)) return;
 	if (returnsBeforeNativeCodexExecution(subcommand, args)) return;
@@ -793,9 +824,13 @@ function returnsBeforeNativeCodexResume(args) {
 async function handleComputerUseCommand(deps, ctx, pluginConfig, args) {
 	const parsed = parseComputerUseArgs(args);
 	if (parsed.help) return ["Usage: /codex computer-use [status|install] [--source <marketplace-source>] [--marketplace-path <path>] [--marketplace <name>]", "Checks or installs the configured Codex Computer Use plugin through app-server."].join("\n");
+	if (Object.keys(parsed.persistentIdentity).length > 0) return formatComputerUsePersistentIdentityMigration(parsed);
 	if (parsed.action === "install" && !canMutateCodexHost(ctx)) return "Only an owner or operator.admin gateway client can configure Codex Computer Use.";
+	const { agentDir } = resolveCodexConversationControlScope(ctx);
 	const params = {
 		pluginConfig,
+		config: ctx.config,
+		agentDir,
 		forceEnable: parsed.action === "install" || parsed.hasOverrides,
 		...Object.keys(parsed.overrides).length > 0 ? { overrides: parsed.overrides } : {}
 	};
@@ -805,6 +840,7 @@ async function handleComputerUseCommand(deps, ctx, pluginConfig, args) {
 async function bindConversation(deps, ctx, pluginConfig, args) {
 	const parsed = parseBindArgs(args);
 	if (parsed.help) return { text: "Usage: /codex bind [thread-id] [--cwd <path>] [--model <model>] [--provider <provider>]" };
+	if (isCurrentSessionModelSelectionLocked(ctx)) return { text: MODEL_SELECTION_LOCKED_MESSAGE };
 	const scope = resolveCodexConversationControlScope(ctx);
 	const workspaceDir = parsed.cwd ?? deps.resolveCodexDefaultWorkspaceDir(pluginConfig);
 	const currentConversation = await ctx.getCurrentConversationBinding();
@@ -818,6 +854,7 @@ async function bindConversation(deps, ctx, pluginConfig, args) {
 	}) : void 0;
 	const currentOwner = currentConversationData?.kind === "codex-app-server-session" ? conversationBindingIdentity(currentConversationData.bindingId) : sessionOwner;
 	const existingBinding = currentOwner ? await deps.bindingStore.read(currentOwner) : void 0;
+	assertCodexBindingMayBeReplaced(existingBinding, "binding this conversation to another thread");
 	const sessionSource = sessionOwner && existingBinding ? {
 		agentId: sessionOwner.agentId,
 		sessionId: sessionOwner.sessionId,
@@ -850,7 +887,9 @@ async function bindConversation(deps, ctx, pluginConfig, args) {
 	return { text: `Bound this conversation to ${formatCodexDisplayText(threadLabel)} in ${formatCodexDisplayText(workspaceDir)}. The next message will initialize it.` };
 }
 async function detachConversation(deps, ctx) {
+	if (isCurrentSessionModelSelectionLocked(ctx)) return MODEL_SELECTION_LOCKED_MESSAGE;
 	const data = readCodexConversationBindingData(await ctx.getCurrentConversationBinding());
+	if (data?.kind === "codex-app-server-session") assertCodexBindingMayBeReplaced(await deps.bindingStore.read(conversationBindingIdentity(data.bindingId)), "detaching its conversation binding");
 	const detached = await ctx.detachConversationBinding();
 	if (data?.kind === "codex-app-server-session") await deps.bindingStore.mutate(conversationBindingIdentity(data.bindingId), { kind: "clear" });
 	return detached.removed ? "Detached this conversation from Codex." : "No Codex conversation binding was attached.";
@@ -882,7 +921,7 @@ async function describeConversationBinding(deps, ctx) {
 	].join("\n");
 }
 async function buildThreads(deps, ctx, pluginConfig, filter) {
-	const scope = await resolveCommandAppServerScope(deps, ctx);
+	const scope = await resolveCommandAppServerScope(deps, ctx, pluginConfig);
 	return formatThreads(await deps.codexControlRequest(pluginConfig, CODEX_CONTROL_METHODS.listThreads, {
 		limit: 10,
 		...filter.trim() ? { searchTerm: filter.trim() } : {}
@@ -906,6 +945,7 @@ async function resumeThread(deps, ctx, pluginConfig, args) {
 	if (parsed.help) return args.includes("--help") || args.includes("-h") || parsed.host ? "Usage: /codex resume <thread-id>\nUsage: /codex resume <session-id> --host <node> --bind here" : "Usage: /codex resume <thread-id>";
 	if (parsed.host) return await bindCodexCliNodeSession(deps, ctx, parsed);
 	if (!normalizedThreadId || args.length !== 1) return "Usage: /codex resume <thread-id>";
+	if (isCurrentSessionModelSelectionLocked(ctx)) return MODEL_SELECTION_LOCKED_MESSAGE;
 	if (!ctx.sessionId) return "Cannot attach a Codex thread because this command did not include an OpenClaw session id.";
 	const scope = resolveCodexConversationControlScope(ctx);
 	const identity = sessionBindingIdentity({
@@ -920,8 +960,10 @@ async function resumeThread(deps, ctx, pluginConfig, args) {
 			identity,
 			config: ctx.config
 		})) throw new Error(`Codex session generation is no longer current: ${identity.sessionId}`);
+		const currentBinding = await deps.bindingStore.read(identity);
+		assertCodexBindingMayBeReplaced(currentBinding, "attaching a different resumed thread");
 		const authProfileId = resolveCodexAppServerAuthProfileIdForAgent({
-			authProfileId: (await deps.bindingStore.read(identity))?.authProfileId,
+			authProfileId: currentBinding?.authProfileId,
 			agentDir: scope.agentDir,
 			config: ctx.config
 		});
@@ -945,6 +987,7 @@ async function resumeThread(deps, ctx, pluginConfig, args) {
 			agentDir: scope.agentDir,
 			config: ctx.config
 		});
+		assertCodexBindingMayBeReplaced(await deps.bindingStore.read(identity), "committing a different resumed thread");
 		if (!await deps.bindingStore.mutate(identity, {
 			kind: "set",
 			binding: {
@@ -961,6 +1004,16 @@ async function resumeThread(deps, ctx, pluginConfig, args) {
 }
 async function bindCodexCliNodeSession(deps, ctx, parsed) {
 	if (!parsed.threadId || !parsed.host || parsed.bindHere !== true) return "Usage: /codex resume <session-id> --host <node> --bind here";
+	if (isCurrentSessionModelSelectionLocked(ctx)) return MODEL_SELECTION_LOCKED_MESSAGE;
+	if (ctx.sessionId) {
+		const scope = resolveCodexConversationControlScope(ctx);
+		assertCodexBindingMayBeReplaced(await deps.bindingStore.read(sessionBindingIdentity({
+			sessionId: ctx.sessionId,
+			sessionKey: ctx.sessionKey,
+			agentId: scope.agentId,
+			config: ctx.config
+		})), "binding a Codex CLI node session");
+	}
 	const resolved = await deps.resolveCodexCliSessionForBindingOnNode({
 		requestedNode: parsed.host,
 		sessionId: parsed.threadId
@@ -1010,10 +1063,11 @@ async function steerConversationTurn(deps, ctx, pluginConfig, message) {
 }
 async function setConversationModel(deps, ctx, pluginConfig, args) {
 	if (args.length > 1) return "Usage: /codex model <model>";
-	const target = await resolveControlTarget(ctx);
-	if (!target) return "Cannot set Codex model because this command did not include a stable binding identity.";
 	const [model = ""] = args;
 	const normalized = model.trim();
+	if (normalized && isCurrentSessionModelSelectionLocked(ctx)) return MODEL_SELECTION_LOCKED_MESSAGE;
+	const target = await resolveControlTarget(ctx);
+	if (!target) return "Cannot set Codex model because this command did not include a stable binding identity.";
 	if (!normalized) {
 		const binding = await deps.bindingStore.read(target.identity);
 		return binding?.model ? `Codex model: ${formatCodexDisplayText(binding.model)}` : "Usage: /codex model <model>";
@@ -1073,19 +1127,25 @@ async function resolveControlTarget(ctx) {
 		agentDir: scope.agentDir
 	} : void 0;
 }
-async function resolveCommandAppServerScope(deps, ctx) {
+async function resolveCommandAppServerScope(deps, ctx, pluginConfig) {
 	const target = await resolveControlTarget(ctx);
 	const fallback = resolveCodexConversationControlScope(ctx);
 	const agentDir = target?.agentDir ?? fallback.agentDir;
-	const authProfileId = resolveCodexAppServerAuthProfileIdForAgent({
-		authProfileId: (target ? await deps.bindingStore.read(target.identity) : void 0)?.authProfileId ?? target?.requestedAuthProfileId,
-		agentDir,
-		config: ctx.config
+	const binding = target ? await deps.bindingStore.read(target.identity) : void 0;
+	const connection = resolveCodexBindingAppServerConnection({
+		binding,
+		authProfileId: binding?.connectionScope === "supervision" ? void 0 : resolveCodexAppServerAuthProfileIdForAgent({
+			authProfileId: binding?.authProfileId ?? target?.requestedAuthProfileId,
+			agentDir,
+			config: ctx.config
+		}),
+		pluginConfig
 	});
 	return {
 		agentId: target?.agentId ?? fallback.agentId,
 		agentDir,
-		...authProfileId ? { authProfileId } : {},
+		...connection.clientAuthProfileId !== void 0 ? { authProfileId: connection.clientAuthProfileId } : {},
+		...connection.usesSupervisionConnection ? { startOptions: connection.appServer.start } : {},
 		...ctx.sessionKey ? { sessionKey: ctx.sessionKey } : {},
 		...ctx.sessionId ? { sessionId: ctx.sessionId } : {}
 	};
@@ -1233,6 +1293,20 @@ async function sendCodexDiagnosticsFeedbackForTargets(deps, ctx, pluginConfig, n
 	const sent = [];
 	const failed = [];
 	for (const target of targets) {
+		let connection;
+		try {
+			connection = resolveCodexBindingAppServerConnection({
+				binding: target,
+				authProfileId: target.authProfileId,
+				pluginConfig
+			});
+		} catch (error) {
+			failed.push({
+				target,
+				error: error instanceof Error ? error.message : String(error)
+			});
+			continue;
+		}
 		const response = await deps.safeCodexControlRequest(pluginConfig, CODEX_CONTROL_METHODS.feedback, {
 			classification: "bug",
 			threadId: target.threadId,
@@ -1242,7 +1316,8 @@ async function sendCodexDiagnosticsFeedbackForTargets(deps, ctx, pluginConfig, n
 		}, {
 			config: ctx.config,
 			agentDir: target.agentDir,
-			...target.authProfileId ? { authProfileId: target.authProfileId } : {},
+			...connection.clientAuthProfileId !== void 0 ? { authProfileId: connection.clientAuthProfileId } : {},
+			...connection.usesSupervisionConnection ? { startOptions: connection.appServer.start } : {},
 			...target.sessionId ? { sessionId: target.sessionId } : {},
 			...target.sessionKey ? { sessionKey: target.sessionKey } : {}
 		});
@@ -1325,13 +1400,31 @@ async function resolvePendingCodexDiagnosticsTargets(deps, targets, config) {
 	return resolved;
 }
 function resolveCodexDiagnosticsTarget(target, binding, config) {
+	const candidate = {
+		identity: target.identity,
+		agentDir: target.agentDir,
+		sessionKey: target.sessionKey,
+		sessionId: target.sessionId,
+		channel: target.channel,
+		channelId: target.channelId,
+		accountId: target.accountId,
+		messageThreadId: target.messageThreadId,
+		threadParentId: target.threadParentId
+	};
+	if (binding.connectionScope === "supervision") return {
+		...candidate,
+		threadId: binding.threadId,
+		connectionScope: binding.connectionScope,
+		appServerRuntimeFingerprint: binding.appServerRuntimeFingerprint,
+		pendingSupervisionBranch: binding.pendingSupervisionBranch
+	};
 	const authProfileId = resolveCodexAppServerAuthProfileIdForAgent({
 		authProfileId: binding.authProfileId,
 		agentDir: target.agentDir,
 		config
 	});
 	return {
-		...target,
+		...candidate,
 		threadId: binding.threadId,
 		authProfileId
 	};
@@ -1340,6 +1433,8 @@ function codexDiagnosticsTargetsMatch(expected, actual) {
 	const fingerprint = (target) => JSON.stringify([
 		bindingStoreKey(target.identity),
 		target.threadId,
+		target.connectionScope ?? null,
+		target.pendingSupervisionBranch?.connectionFingerprint ?? target.appServerRuntimeFingerprint ?? null,
 		target.authProfileId ?? null
 	]);
 	const expectedTargets = expected.map(fingerprint).toSorted();
@@ -1387,7 +1482,7 @@ function formatCodexDiagnosticsTargetLine(target) {
 }
 function normalizeDiagnosticsReason(note) {
 	const normalized = normalizeOptionalString(note);
-	return normalized ? normalized.slice(0, CODEX_DIAGNOSTICS_REASON_MAX_CHARS) : void 0;
+	return normalized ? truncateUtf16Safe(normalized, CODEX_DIAGNOSTICS_REASON_MAX_CHARS) : void 0;
 }
 function parseDiagnosticsArgs(args) {
 	const [action, token, ...extra] = splitArgs(args);
@@ -1590,7 +1685,7 @@ function pruneCodexDiagnosticsCooldownMap(map, now) {
 	for (const [key, lastSentAt] of map) if (now - lastSentAt >= CODEX_DIAGNOSTICS_COOLDOWN_MS) map.delete(key);
 }
 function formatCodexErrorForDisplay(error) {
-	return escapeCodexChatText(formatCodexTextForDisplay(error).slice(0, CODEX_DIAGNOSTICS_ERROR_MAX_CHARS)) || "unknown error";
+	return escapeCodexChatText(truncateUtf16Safe(formatCodexTextForDisplay(error), CODEX_DIAGNOSTICS_ERROR_MAX_CHARS)) || "unknown error";
 }
 function formatCodexResumeCommandForDisplay(threadId) {
 	const safeThreadId = formatCodexTextForDisplay(threadId);
@@ -1613,13 +1708,19 @@ async function startThreadAction(deps, ctx, pluginConfig, kind, args) {
 	if (!target) return `Cannot start Codex ${label} because this command did not include a stable binding identity.`;
 	const binding = await deps.bindingStore.read(target.identity);
 	if (!binding?.threadId) return `No Codex thread is attached to this OpenClaw session yet.`;
+	const connection = resolveCodexBindingAppServerConnection({
+		binding,
+		authProfileId: binding.authProfileId,
+		pluginConfig
+	});
 	await deps.codexControlRequest(pluginConfig, kind === "compact" ? CODEX_CONTROL_METHODS.compact : CODEX_CONTROL_METHODS.review, kind === "review" ? {
 		threadId: binding.threadId,
 		target: { type: "uncommittedChanges" }
 	} : { threadId: binding.threadId }, {
 		agentDir: target.agentDir,
-		authProfileId: binding.authProfileId,
-		config: ctx.config
+		authProfileId: connection.clientAuthProfileId,
+		config: ctx.config,
+		...connection.usesSupervisionConnection ? { startOptions: connection.appServer.start } : {}
 	});
 	return `Started Codex ${label} for thread ${formatCodexDisplayText(binding.threadId)}.`;
 }
@@ -1671,7 +1772,7 @@ function splitArgs(value) {
 function parseBindArgs(args) {
 	const parsed = {};
 	for (let index = 0; index < args.length; index += 1) {
-		const arg = args[index];
+		const arg = expectDefined(args[index], "current Codex bind argument");
 		if (arg === "--help" || arg === "-h") {
 			parsed.help = true;
 			continue;
@@ -1722,7 +1823,7 @@ function parseCodexCliSessionsArgs(args) {
 	const parsed = { filter: "" };
 	const filter = [];
 	for (let index = 0; index < args.length; index += 1) {
-		const arg = args[index];
+		const arg = expectDefined(args[index], "current Codex sessions argument");
 		if (arg === "--help" || arg === "-h") {
 			parsed.help = true;
 			continue;
@@ -1760,7 +1861,7 @@ function parseCodexCliSessionsArgs(args) {
 function parseResumeArgs(args) {
 	const parsed = {};
 	for (let index = 0; index < args.length; index += 1) {
-		const arg = args[index];
+		const arg = expectDefined(args[index], "current Codex resume argument");
 		if (arg === "--help" || arg === "-h") {
 			parsed.help = true;
 			continue;
@@ -1798,7 +1899,8 @@ function parseComputerUseArgs(args) {
 	const parsed = {
 		action: "status",
 		overrides: {},
-		hasOverrides: false
+		hasOverrides: false,
+		persistentIdentity: {}
 	};
 	let sawAction = false;
 	for (let index = 0; index < args.length; index += 1) {
@@ -1846,23 +1948,14 @@ function parseComputerUseArgs(args) {
 			index += 1;
 			continue;
 		}
-		if (arg === "--plugin") {
-			const value = readRequiredOptionValue(args, index);
-			if (!value || parsed.overrides.pluginName !== void 0) {
-				parsed.help = true;
-				continue;
-			}
-			parsed.overrides.pluginName = value;
-			index += 1;
-			continue;
-		}
-		if (arg === "--server" || arg === "--mcp-server") {
+		if (arg === "--plugin" || arg === "--server" || arg === "--mcp-server") {
 			const value = readRequiredOptionValue(args, index);
-			if (!value || parsed.overrides.mcpServerName !== void 0) {
+			const configKey = arg === "--plugin" ? "pluginName" : "mcpServerName";
+			if (!value || parsed.persistentIdentity[configKey] !== void 0) {
 				parsed.help = true;
 				continue;
 			}
-			parsed.overrides.mcpServerName = value;
+			parsed.persistentIdentity[configKey] = value.trim();
 			index += 1;
 			continue;
 		}
@@ -1872,6 +1965,17 @@ function parseComputerUseArgs(args) {
 	parsed.hasOverrides = Object.values(parsed.overrides).some(Boolean);
 	return parsed;
 }
+function formatComputerUsePersistentIdentityMigration(parsed) {
+	const configPrefix = "plugins.entries.codex.config.computerUse";
+	const settings = [parsed.persistentIdentity.pluginName ? `${configPrefix}.pluginName = ${JSON.stringify(parsed.persistentIdentity.pluginName)}` : void 0, parsed.persistentIdentity.mcpServerName ? `${configPrefix}.mcpServerName = ${JSON.stringify(parsed.persistentIdentity.mcpServerName)}` : void 0].filter((setting) => Boolean(setting));
+	const retryArgs = [
+		`/codex computer-use ${parsed.action}`,
+		parsed.overrides.marketplaceSource ? `--source ${JSON.stringify(parsed.overrides.marketplaceSource)}` : void 0,
+		parsed.overrides.marketplacePath ? `--marketplace-path ${JSON.stringify(parsed.overrides.marketplacePath)}` : void 0,
+		parsed.overrides.marketplaceName ? `--marketplace ${JSON.stringify(parsed.overrides.marketplaceName)}` : void 0
+	].filter((arg) => Boolean(arg));
+	return ["One-off Computer Use plugin/server overrides are no longer supported.", `Set ${settings.join(" and ")} persistently, then rerun ${retryArgs.join(" ")}.`].join(" ");
+}
 function readRequiredOptionValue(args, index) {
 	const value = args[index + 1];
 	const normalized = value?.trim();
@@ -1886,10 +1990,6 @@ function normalizeComputerUseStringOverrides(overrides) {
 	if (marketplacePath) normalized.marketplacePath = marketplacePath;
 	const marketplaceName = normalizeOptionalString(overrides.marketplaceName);
 	if (marketplaceName) normalized.marketplaceName = marketplaceName;
-	const pluginName = normalizeOptionalString(overrides.pluginName);
-	if (pluginName) normalized.pluginName = pluginName;
-	const mcpServerName = normalizeOptionalString(overrides.mcpServerName);
-	if (mcpServerName) normalized.mcpServerName = mcpServerName;
 	return normalized;
 }
 //#endregion

package/dist/{compact-4mVBriKT.js → compact-DCTmg3id.js}

@@ -1,10 +1,9 @@
-import { r as isJsonObject } from "./protocol-2POPqAY4.js";
-import { _ as readCodexNotificationItem } from "./attempt-notifications-BGsEIIDI.js";
-import { d as resolveCodexAppServerRuntimeOptions } from "./config-CYEDnLJ2.js";
-import { a as getLeasedSharedCodexAppServerClient, o as releaseLeasedSharedCodexAppServerClient, u as CodexAppServerRpcError } from "./shared-client-4ICy3U6d.js";
-import { s as sessionBindingIdentity, t as CODEX_APP_SERVER_BINDING_GUARDED_REQUEST_TIMEOUT_MS } from "./session-binding-C1ZXdP-x.js";
-import { n as resolveCodexNativeExecutionBlock } from "./sandbox-guard-DA2TQfZW.js";
-import { n as readCodexNotificationThreadId, r as readCodexNotificationTurnId } from "./notification-correlation-Bo7KB3ks.js";
+import { R as CodexAppServerRpcError, Z as isJsonObject, a as getLeasedSharedCodexAppServerClient, c as releaseLeasedSharedCodexAppServerClient } from "./shared-client-JiAnW6pc.js";
+import { _ as readCodexNotificationItem } from "./attempt-notifications-BFmNhqFl.js";
+import { c as sessionBindingIdentity, t as CODEX_APP_SERVER_BINDING_GUARDED_REQUEST_TIMEOUT_MS } from "./session-binding-h1mmCGnl.js";
+import { n as resolveCodexNativeExecutionBlock } from "./sandbox-guard-D1Wky__S.js";
+import { a as resolveCodexBindingAppServerConnection, n as readCodexNotificationThreadId, r as readCodexNotificationTurnId } from "./notification-correlation-KmfV4EkP.js";
+import { resolveAgentDir, resolveDefaultAgentId } from "openclaw/plugin-sdk/agent-runtime";
 import { embeddedAgentLog, resolveCompactionTimeoutMs } from "openclaw/plugin-sdk/agent-harness-runtime";
 //#region extensions/codex/src/app-server/compact.ts
 /**
@@ -331,7 +330,6 @@ async function compactCodexNativeThread(params, options) {
 		compacted: false,
 		reason: nativeExecutionBlock
 	};
-	const appServer = resolveCodexAppServerRuntimeOptions({ pluginConfig: options.pluginConfig });
 	const bindingIdentity = sessionBindingIdentity({
 		sessionId: params.sessionId,
 		sessionKey: params.sessionKey,
@@ -345,18 +343,48 @@ async function compactCodexNativeThread(params, options) {
 	});
 	let binding = initialBinding;
 	const requestedAuthProfileId = params.authProfileId?.trim() || void 0;
-	if (requestedAuthProfileId && binding.authProfileId && binding.authProfileId !== requestedAuthProfileId) return {
+	let connection;
+	try {
+		const config = params.config ?? {};
+		const agentId = params.agentId ?? readAgentIdFromSessionKey(params.sessionKey) ?? resolveDefaultAgentId(config);
+		connection = resolveCodexBindingAppServerConnection({
+			binding,
+			authProfileId: requestedAuthProfileId ?? binding.authProfileId,
+			pluginConfig: options.pluginConfig,
+			config,
+			agentDir: resolveAgentDir(config, agentId)
+		});
+	} catch (error) {
+		return {
+			ok: false,
+			compacted: false,
+			reason: formatCompactionError(error)
+		};
+	}
+	const { appServer, usesSupervisionConnection } = connection;
+	if (!usesSupervisionConnection && requestedAuthProfileId && binding.authProfileId && binding.authProfileId !== requestedAuthProfileId) return {
 		ok: false,
 		compacted: false,
 		reason: "auth profile mismatch for session binding"
 	};
 	const shouldReleaseDefaultLease = !options.clientFactory;
 	const clientFactory = options.clientFactory ?? getLeasedSharedCodexAppServerClient;
+	const runtimeAuthPlan = params.runtimeAuthPlan ?? params.runtimePlan?.auth;
+	const usesPreparedApiKey = !usesSupervisionConnection && runtimeAuthPlan?.modelRoute?.authRequirement === "api-key";
+	const preparedApiKey = usesPreparedApiKey ? params.resolvedApiKey?.trim() : void 0;
+	if (usesPreparedApiKey && !preparedApiKey) return {
+		ok: false,
+		compacted: false,
+		reason: "Prepared Codex Platform compaction route is missing its resolved API key."
+	};
 	try {
 		return await runExclusiveCodexNativeCompaction(binding.threadId, params.abortSignal, async () => {
 			const client = await clientFactory({
 				startOptions: appServer.start,
-				authProfileId: requestedAuthProfileId ?? binding.authProfileId,
+				...preparedApiKey ? { preparedAuth: {
+					kind: "api-key",
+					apiKey: preparedApiKey
+				} } : { authProfileId: connection.clientAuthProfileId },
 				agentDir: params.agentDir,
 				config: params.config
 			});
@@ -375,6 +403,7 @@ async function compactCodexNativeThread(params, options) {
 						if (transportStopped) return;
 						throw new Error("failed to stop unconfirmed codex app-server process");
 					}
+					if (usesSupervisionConnection) throw new Error("cannot detach an unconfirmed supervised codex thread");
 					if (await options.bindingStore.mutate(bindingIdentity, {
 						kind: "clear",
 						threadId: binding.threadId