@openclaw/codex 2026.7.1 → 2026.7.2-beta.2

package/dist/{media-understanding-provider-BHOu9-Gg.js → media-understanding-provider-D31dOJwb.js}

@@ -1,10 +1,9 @@
-import { CODEX_PROVIDER_ID, FALLBACK_CODEX_MODELS } from "./provider-catalog.js";
-import { r as isJsonObject } from "./protocol-2POPqAY4.js";
-import { _ as readCodexNotificationItem } from "./attempt-notifications-BGsEIIDI.js";
-import { d as resolveCodexAppServerRuntimeOptions } from "./config-CYEDnLJ2.js";
-import { i as assertCodexTurnStartResponse, l as readCodexTurnCompletedNotification, o as readCodexErrorNotification, r as assertCodexThreadStartResponse } from "./protocol-validators-dZQ-UTOa.js";
-import { i as readModelListResult } from "./models-DDmO1zwd.js";
-import { H as mergeCodexThreadConfigs, r as buildCodexRuntimeThreadConfig } from "./thread-lifecycle-qWE88Dn2.js";
+import { Z as isJsonObject, o as isCodexAppServerStartSelectionChangedError } from "./shared-client-JiAnW6pc.js";
+import { _ as readCodexNotificationItem } from "./attempt-notifications-BFmNhqFl.js";
+import { b as resolveCodexAppServerRuntimeOptions } from "./session-binding-h1mmCGnl.js";
+import { _ as readCodexTurnCompletedNotification, d as assertCodexThreadStartResponse, f as assertCodexTurnStartResponse, m as readCodexErrorNotification } from "./transcript-mirror-D9rTxx2P.js";
+import { r as readModelListResult } from "./models-uh26C8QU.js";
+import { J as mergeCodexThreadConfigs, l as buildCodexRuntimeThreadConfig } from "./thread-lifecycle-CN_pPtPh.js";
 import { validateJsonSchemaValue } from "openclaw/plugin-sdk/json-schema-runtime";
 import fs from "node:fs/promises";
 import path from "node:path";
@@ -30,7 +29,10 @@ const CODEX_PRIVATE_BOUNDED_THREAD_CONFIG = {
 	notify: []
 };
 async function runBoundedCodexAppServerTurn(params) {
-	const appServer = resolveCodexAppServerRuntimeOptions({ pluginConfig: params.options.pluginConfig });
+	const appServer = resolveCodexAppServerRuntimeOptions({
+		pluginConfig: params.options.pluginConfig,
+		managedCommandOrder: params.isolation === "private-stdio" ? "package-first" : void 0
+	});
 	if (params.isolation === "configured-transport") return await runBoundedCodexAppServerTurnInWorkspace(params, appServer, { cwd: params.agentDir?.trim() || process.cwd() });
 	if (appServer.start.transport !== "stdio") throw new Error("Bounded Codex turns require stdio transport so native tools can be isolated.");
 	return await withTempWorkspace({
@@ -46,8 +48,11 @@ async function runBoundedCodexAppServerTurn(params) {
 		});
 	});
 }
-async function runBoundedCodexAppServerTurnInWorkspace(params, appServer, workspace) {
-	const timeoutMs = resolveTimerTimeoutMs(params.timeoutMs, 100, 100);
+async function runBoundedCodexAppServerTurnInWorkspace(params, appServer, workspace, selectionAttempt = 0, timing) {
+	const totalTimeoutMs = timing?.timeoutMs ?? resolveTimerTimeoutMs(params.timeoutMs, 100, 100);
+	const deadline = timing?.deadline ?? Date.now() + totalTimeoutMs;
+	const timeoutMs = deadline - Date.now();
+	if (timeoutMs <= 0) throw new Error(`${params.taskLabel} timed out`);
 	const agentDir = params.agentDir?.trim() || void 0;
 	const startOptions = workspace.codexHome ? buildPrivateCodexAppServerStartOptions(appServer.start, workspace.codexHome) : appServer.start;
 	const ownsClient = !params.options.clientFactory;
@@ -57,7 +62,7 @@ async function runBoundedCodexAppServerTurnInWorkspace(params, appServer, worksp
 		agentDir,
 		config: params.config,
 		timeoutMs
-	}) : await import("./shared-client-4ICy3U6d.js").then((n) => n.c).then(({ createIsolatedCodexAppServerClient }) => createIsolatedCodexAppServerClient({
+	}) : await import("./shared-client-JiAnW6pc.js").then((n) => n.f).then(({ createIsolatedCodexAppServerClient }) => createIsolatedCodexAppServerClient({
 		startOptions,
 		timeoutMs,
 		authProfileId: params.profile,
@@ -69,8 +74,11 @@ async function runBoundedCodexAppServerTurnInWorkspace(params, appServer, worksp
 	const abortFromCaller = () => abortController.abort(params.signal?.reason ?? "aborted");
 	if (params.signal?.aborted) abortFromCaller();
 	else params.signal?.addEventListener("abort", abortFromCaller, { once: true });
-	const timeout = setTimeout(() => abortController.abort("timeout"), timeoutMs);
+	const remainingRunMs = deadline - Date.now();
+	if (remainingRunMs <= 0) abortController.abort("timeout");
+	const timeout = setTimeout(() => abortController.abort("timeout"), Math.max(1, remainingRunMs));
 	timeout.unref?.();
+	let retrySelection = false;
 	try {
 		const model = await resolveCodexBoundedTurnModel({
 			client,
@@ -122,11 +130,19 @@ async function runBoundedCodexAppServerTurnInWorkspace(params, appServer, worksp
 			requestCleanup();
 			cleanup();
 		}
+	} catch (error) {
+		if (ownsClient && isCodexAppServerStartSelectionChangedError(error) && selectionAttempt === 0) retrySelection = true;
+		else throw error;
 	} finally {
 		clearTimeout(timeout);
 		params.signal?.removeEventListener("abort", abortFromCaller);
 		if (ownsClient) client.close();
 	}
+	if (retrySelection) return await runBoundedCodexAppServerTurnInWorkspace(params, appServer, workspace, selectionAttempt + 1, {
+		deadline,
+		timeoutMs: totalTimeoutMs
+	});
+	throw new Error("Codex bounded turn selection retry exited unexpectedly");
 }
 function resolveBoundedThreadConfig(params, workspace) {
 	const boundedConfig = mergeCodexThreadConfigs(CODEX_BOUNDED_THREAD_CONFIG, params.threadConfig) ?? CODEX_BOUNDED_THREAD_CONFIG;
@@ -305,7 +321,8 @@ function isTerminalTurn(turn) {
 * Codex-backed media understanding provider for bounded image description and
 * structured extraction turns.
 */
-const DEFAULT_CODEX_IMAGE_MODEL = FALLBACK_CODEX_MODELS.find((model) => model.inputModalities.includes("image"))?.id ?? FALLBACK_CODEX_MODELS[0]?.id;
+const CODEX_MEDIA_PROVIDER_ID = "codex";
+const DEFAULT_CODEX_IMAGE_MODEL = "gpt-5.6-sol";
 const DEFAULT_CODEX_IMAGE_PROMPT = "Describe the image.";
 /**
 * Builds the media-understanding provider that delegates image tasks to an
@@ -313,9 +330,9 @@ const DEFAULT_CODEX_IMAGE_PROMPT = "Describe the image.";
 */
 function buildCodexMediaUnderstandingProvider(options = {}) {
 	return {
-		id: CODEX_PROVIDER_ID,
+		id: CODEX_MEDIA_PROVIDER_ID,
 		capabilities: ["image"],
-		...DEFAULT_CODEX_IMAGE_MODEL ? { defaultModels: { image: DEFAULT_CODEX_IMAGE_MODEL } } : {},
+		defaultModels: { image: DEFAULT_CODEX_IMAGE_MODEL },
 		describeImage: async (req) => describeCodexImages({
 			images: [{
 				buffer: req.buffer,

package/dist/media-understanding-provider.js

@@ -1,2 +1,2 @@
-import { t as buildCodexMediaUnderstandingProvider } from "./media-understanding-provider-BHOu9-Gg.js";
+import { t as buildCodexMediaUnderstandingProvider } from "./media-understanding-provider-D31dOJwb.js";
 export { buildCodexMediaUnderstandingProvider };

package/dist/{models-DDmO1zwd.js → models-uh26C8QU.js}

@@ -1,16 +1,10 @@
-import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
-import { s as readCodexModelListResponse } from "./protocol-validators-dZQ-UTOa.js";
+import { h as readCodexModelListResponse } from "./transcript-mirror-D9rTxx2P.js";
 import { uniqueStrings } from "openclaw/plugin-sdk/string-coerce-runtime";
 //#region extensions/codex/src/app-server/models.ts
 /**
 * Lists and normalizes models exposed by the Codex app-server `model/list`
 * endpoint, including pagination and shared-client lease handling.
 */
-var models_exports = /* @__PURE__ */ __exportAll({
-	listAllCodexAppServerModels: () => listAllCodexAppServerModels,
-	listCodexAppServerModels: () => listCodexAppServerModels,
-	readModelListResult: () => readModelListResult
-});
 /** Lists one Codex app-server model page using the configured auth/client options. */
 async function listCodexAppServerModels(options = {}) {
 	return await withCodexAppServerModelClient(options, async ({ client, timeoutMs }) => requestModelListPage(client, {
@@ -46,17 +40,19 @@ async function listAllCodexAppServerModels(options = {}) {
 async function withCodexAppServerModelClient(options, run) {
 	const timeoutMs = options.timeoutMs ?? 2500;
 	const useSharedClient = options.sharedClient !== false;
-	const { createIsolatedCodexAppServerClient, getLeasedSharedCodexAppServerClient, releaseLeasedSharedCodexAppServerClient } = await import("./shared-client-4ICy3U6d.js").then((n) => n.c);
+	const { createIsolatedCodexAppServerClient, getLeasedSharedCodexAppServerClient, releaseLeasedSharedCodexAppServerClient } = await import("./shared-client-JiAnW6pc.js").then((n) => n.f);
 	const client = useSharedClient ? await getLeasedSharedCodexAppServerClient({
 		startOptions: options.startOptions,
 		timeoutMs,
 		authProfileId: options.authProfileId,
+		authRequirement: options.authRequirement,
 		agentDir: options.agentDir,
 		config: options.config
 	}) : await createIsolatedCodexAppServerClient({
 		startOptions: options.startOptions,
 		timeoutMs,
 		authProfileId: options.authProfileId,
+		authRequirement: options.authRequirement,
 		agentDir: options.agentDir,
 		config: options.config
 	});
@@ -115,4 +111,4 @@ function normalizeMaxPages(value) {
 	return typeof value === "number" && Number.isFinite(value) && value > 0 ? Math.floor(value) : 20;
 }
 //#endregion
-export { readModelListResult as i, listCodexAppServerModels as n, models_exports as r, listAllCodexAppServerModels as t };
+export { listCodexAppServerModels as n, readModelListResult as r, listAllCodexAppServerModels as t };

package/dist/notification-correlation-KmfV4EkP.js

@@ -0,0 +1,67 @@
+import { Z as isJsonObject } from "./shared-client-JiAnW6pc.js";
+import { E as resolveCodexSupervisionAppServerRuntimeOptions, b as resolveCodexAppServerRuntimeOptions, y as readCodexPluginConfig } from "./session-binding-h1mmCGnl.js";
+import { t as buildCodexAppServerConnectionFingerprint } from "./plugin-app-cache-key-Ceb-lm2c.js";
+//#region extensions/codex/src/app-server/binding-connection.ts
+/** Requires the native model pair after a supervised pending branch has materialized. */
+function requireCodexSupervisionModelSelection(binding) {
+	const model = binding.model?.trim();
+	const modelProvider = binding.modelProvider?.trim();
+	if (binding.connectionScope !== "supervision" || !model || !modelProvider) throw new Error("Codex supervised binding is missing its native model and provider; refusing request selection");
+	return {
+		model,
+		modelProvider
+	};
+}
+/** Resolves connection and auth ownership exclusively from the private thread binding. */
+function resolveCodexBindingAppServerConnection(params) {
+	const { binding, authProfileId, ...runtimeParams } = params;
+	const usesSupervisionConnection = binding?.connectionScope === "supervision";
+	if (usesSupervisionConnection && readCodexPluginConfig(runtimeParams.pluginConfig).supervision?.enabled !== true) throw new Error("Codex supervision is disabled; refusing to open a native user-home supervised session");
+	const appServer = (usesSupervisionConnection ? resolveCodexSupervisionAppServerRuntimeOptions : resolveCodexAppServerRuntimeOptions)(runtimeParams);
+	if (usesSupervisionConnection) {
+		const persistedFingerprint = binding.pendingSupervisionBranch?.connectionFingerprint ?? binding.appServerRuntimeFingerprint;
+		const currentFingerprint = buildCodexAppServerConnectionFingerprint(appServer, runtimeParams.agentDir);
+		if (!persistedFingerprint || persistedFingerprint !== currentFingerprint) throw new Error("Codex supervision connection changed; refusing to operate on its bound native thread");
+	}
+	return {
+		appServer,
+		usesSupervisionConnection,
+		requestAuthProfileId: usesSupervisionConnection ? void 0 : authProfileId,
+		clientAuthProfileId: usesSupervisionConnection ? null : authProfileId
+	};
+}
+//#endregion
+//#region extensions/codex/src/app-server/notification-correlation.ts
+/**
+* Correlates Codex app-server notifications with the active thread/turn so
+* projectors can ignore global or stale events without losing diagnostics.
+*/
+/** Returns true when a notification payload belongs to the exact active thread and turn. */
+function isCodexNotificationForTurn(value, threadId, turnId) {
+	if (!isJsonObject(value)) return false;
+	return readCodexNotificationThreadId(value) === threadId && readCodexNotificationTurnId(value) === turnId;
+}
+/**
+* Reads a thread id from canonical top-level or nested thread payloads.
+* The generated v2 schemas require top-level `threadId` on turn/item-scoped
+* notifications and define `Turn` without one, so `turn.threadId` is not a
+* wire shape and is deliberately not read here.
+*/
+function readCodexNotificationThreadId(record) {
+	const thread = isJsonObject(record.thread) ? record.thread : void 0;
+	return readString(record, "threadId") ?? (thread ? readString(thread, "id") : void 0);
+}
+/** Reads a turn id from either top-level notification params or nested turn payloads. */
+function readCodexNotificationTurnId(record) {
+	return readNestedTurnId(record) ?? readString(record, "turnId");
+}
+function readNestedTurnId(record) {
+	const turn = record.turn;
+	return isJsonObject(turn) ? readString(turn, "id") : void 0;
+}
+function readString(record, key) {
+	const value = record[key];
+	return typeof value === "string" && value.trim() ? value.trim() : void 0;
+}
+//#endregion
+export { resolveCodexBindingAppServerConnection as a, requireCodexSupervisionModelSelection as i, readCodexNotificationThreadId as n, readCodexNotificationTurnId as r, isCodexNotificationForTurn as t };

package/dist/plugin-app-cache-key-Ceb-lm2c.js

@@ -0,0 +1,315 @@
+import { D as resolveCodexAppServerHomeDir } from "./shared-client-JiAnW6pc.js";
+import { S as resolveCodexAppServerUserHomeDir } from "./session-binding-h1mmCGnl.js";
+import { createRequire } from "node:module";
+import { isFutureDateTimestampMs, resolveDateTimestampMs, resolveExpiresAtMsFromDurationMs } from "openclaw/plugin-sdk/number-runtime";
+import { truncateUtf16Safe } from "openclaw/plugin-sdk/text-utility-runtime";
+import { createHash } from "node:crypto";
+import { isRecord } from "openclaw/plugin-sdk/string-coerce-runtime";
+import { OPENCLAW_VERSION, embeddedAgentLog } from "openclaw/plugin-sdk/agent-harness-runtime";
+import { readPluginPackageVersion } from "openclaw/plugin-sdk/extension-shared";
+//#region extensions/codex/src/app-server/app-inventory-cache.ts
+/**
+* Process-local cache for Codex app-server app inventories, keyed by runtime
+* identity and safe to refresh in the background.
+*/
+/** Default app inventory cache freshness window. */
+const CODEX_APP_INVENTORY_CACHE_TTL_MS = 3600 * 1e3;
+const CODEX_TARGETED_APP_INVENTORY_LIMIT = 1e3;
+const MAX_SERIALIZED_ERROR_MESSAGE_LENGTH = 500;
+/** In-memory app inventory cache with coalesced refreshes per key. */
+var CodexAppInventoryCache = class {
+	constructor(options = {}) {
+		this.entries = /* @__PURE__ */ new Map();
+		this.inFlight = /* @__PURE__ */ new Map();
+		this.refreshTokens = /* @__PURE__ */ new Map();
+		this.diagnostics = /* @__PURE__ */ new Map();
+		this.revision = 0;
+		this.ttlMs = options.ttlMs ?? CODEX_APP_INVENTORY_CACHE_TTL_MS;
+	}
+	/** Reads a snapshot and schedules refresh when missing, stale, or forced. */
+	read(params) {
+		const nowMs = resolveDateTimestampMs(params.nowMs);
+		const entry = this.entries.get(params.key);
+		if (!entry) {
+			const refreshScheduled = params.suppressRefresh ? false : this.scheduleRefresh(params);
+			return {
+				state: "missing",
+				key: params.key,
+				revision: this.revision,
+				refreshScheduled,
+				...this.diagnostics.get(params.key) ? { diagnostic: this.diagnostics.get(params.key) } : {}
+			};
+		}
+		const state = entry.invalidated || !isFutureDateTimestampMs(entry.expiresAtMs, { nowMs }) ? "stale" : "fresh";
+		const refreshScheduled = state === "fresh" && !params.forceRefetch ? false : this.scheduleRefresh(params);
+		return {
+			state,
+			key: params.key,
+			revision: entry.revision,
+			snapshot: stripEntryState(entry),
+			refreshScheduled,
+			...entry.lastError ? { diagnostic: entry.lastError } : {}
+		};
+	}
+	/** Forces or joins an immediate refresh for a cache key. */
+	refreshNow(params) {
+		return this.refresh(params);
+	}
+	/** Marks a key stale and records the reason as a diagnostic. */
+	invalidate(key, reason, nowMs = Date.now()) {
+		this.revision += 1;
+		const diagnostic = {
+			message: reason,
+			atMs: nowMs
+		};
+		const entry = this.entries.get(key);
+		if (entry) {
+			entry.invalidated = true;
+			entry.lastError = diagnostic;
+			entry.revision = this.revision;
+		} else this.diagnostics.set(key, diagnostic);
+		return this.revision;
+	}
+	/** Clears all cached snapshots, diagnostics, in-flight requests, and revision state. */
+	clear() {
+		this.entries.clear();
+		this.inFlight.clear();
+		this.refreshTokens.clear();
+		this.diagnostics.clear();
+		this.revision = 0;
+	}
+	/** Returns the monotonically increasing cache revision. */
+	getRevision() {
+		return this.revision;
+	}
+	scheduleRefresh(params) {
+		if (this.inFlight.has(params.key) && !params.forceRefetch) return true;
+		const promise = this.refresh(params);
+		this.inFlight.set(params.key, promise);
+		promise.catch(() => void 0);
+		return true;
+	}
+	async refresh(params) {
+		const existing = this.inFlight.get(params.key);
+		if (existing && !params.forceRefetch) return existing;
+		const refreshToken = (this.refreshTokens.get(params.key) ?? 0) + 1;
+		this.refreshTokens.set(params.key, refreshToken);
+		const promise = this.refreshUncoalesced(params, refreshToken);
+		this.inFlight.set(params.key, promise);
+		try {
+			return await promise;
+		} finally {
+			if (this.inFlight.get(params.key) === promise) this.inFlight.delete(params.key);
+		}
+	}
+	async refreshUncoalesced(params, refreshToken) {
+		const nowMs = resolveDateTimestampMs(params.nowMs);
+		try {
+			const apps = await listAllApps(params.request, params.forceRefetch ?? false, params.targetAppIds);
+			this.revision += 1;
+			const expiresAtMs = resolveExpiresAtMsFromDurationMs(this.ttlMs, { nowMs }) ?? 0;
+			const snapshot = {
+				key: params.key,
+				apps,
+				fetchedAtMs: nowMs,
+				expiresAtMs,
+				revision: this.revision
+			};
+			if (this.refreshTokens.get(params.key) === refreshToken) {
+				this.entries.set(params.key, {
+					...snapshot,
+					invalidated: false
+				});
+				this.diagnostics.delete(params.key);
+			}
+			return snapshot;
+		} catch (error) {
+			const diagnostic = {
+				message: sanitizeErrorMessage(error instanceof Error ? error.message : String(error)),
+				atMs: nowMs
+			};
+			this.diagnostics.set(params.key, diagnostic);
+			const entry = this.entries.get(params.key);
+			if (entry) entry.lastError = diagnostic;
+			embeddedAgentLog.warn("codex app inventory refresh failed", {
+				forceRefetch: params.forceRefetch === true,
+				keyFingerprint: fingerprintInventoryCacheKey(params.key),
+				error: serializeCodexAppInventoryError(error)
+			});
+			throw error;
+		}
+	}
+};
+/** Serializes a refresh failure without leaking large or sensitive error data. */
+function serializeCodexAppInventoryError(error) {
+	const record = isRecord(error) ? error : void 0;
+	const data = record && "data" in record ? redactErrorData(record.data) : void 0;
+	return {
+		name: error instanceof Error ? error.name : typeof record?.name === "string" ? record.name : void 0,
+		message: sanitizeErrorMessage(error instanceof Error ? error.message : String(error)),
+		...typeof record?.code === "number" ? { code: record.code } : {},
+		...data !== void 0 ? { data } : {}
+	};
+}
+/** Shared app inventory cache used by Codex app-server runtime paths. */
+const defaultCodexAppInventoryCache = new CodexAppInventoryCache();
+/** Builds a stable cache key from build versions and runtime identity fields. */
+function buildCodexAppInventoryCacheKey(input, openClawVersion, codexPluginVersion) {
+	return JSON.stringify({
+		openClawVersion,
+		codexPluginVersion,
+		codexHome: input.codexHome ?? null,
+		endpoint: input.endpoint ?? null,
+		runtimeIdentity: normalizeRuntimeIdentityForCacheKey(input.runtimeIdentity),
+		authProfileId: input.authProfileId ?? null,
+		accountId: input.accountId ?? null,
+		envApiKeyFingerprint: input.envApiKeyFingerprint ?? null,
+		appServerVersion: input.appServerVersion ?? null
+	});
+}
+function normalizeRuntimeIdentityForCacheKey(value) {
+	if (!value) return null;
+	const entries = Object.entries(value).flatMap(([key, rawValue]) => {
+		const normalized = rawValue?.trim();
+		return normalized ? [[key, normalized]] : [];
+	}).toSorted(([left], [right]) => left.localeCompare(right));
+	return entries.length > 0 ? Object.fromEntries(entries) : null;
+}
+async function listAllApps(request, forceRefetch, targetAppIds = []) {
+	const apps = [];
+	const targetIds = new Set(targetAppIds.filter(Boolean));
+	const remainingTargetIds = new Set(targetIds);
+	const seenCursors = /* @__PURE__ */ new Set();
+	let cursor;
+	do {
+		const response = await request("app/list", {
+			cursor,
+			limit: targetIds.size > 0 ? CODEX_TARGETED_APP_INVENTORY_LIMIT : 100,
+			forceRefetch
+		});
+		apps.push(...response.data);
+		for (const app of response.data) remainingTargetIds.delete(app.id);
+		if (targetIds.size > 0 && remainingTargetIds.size === 0) break;
+		cursor = response.nextCursor;
+		if (cursor && seenCursors.has(cursor)) throw new Error(`app/list returned repeated cursor ${cursor}`);
+		if (cursor) seenCursors.add(cursor);
+	} while (cursor);
+	return apps;
+}
+function stripEntryState(entry) {
+	const { invalidated: _invalidated, ...snapshot } = entry;
+	return snapshot;
+}
+function fingerprintInventoryCacheKey(key) {
+	let hash = 0;
+	for (let index = 0; index < key.length; index += 1) hash = hash * 31 + key.charCodeAt(index) >>> 0;
+	return hash.toString(16).padStart(8, "0");
+}
+function truncateSerializedErrorText(value) {
+	return value.length > MAX_SERIALIZED_ERROR_MESSAGE_LENGTH ? `${truncateUtf16Safe(value, MAX_SERIALIZED_ERROR_MESSAGE_LENGTH)}...` : value;
+}
+function redactErrorData(value, depth = 0) {
+	if (value === void 0) return;
+	if (value === null || typeof value === "boolean" || typeof value === "number") return value;
+	if (depth > 6) return "[truncated]";
+	if (Array.isArray(value)) return value.map((entry) => redactErrorData(entry, depth + 1) ?? null);
+	if (isRecord(value)) {
+		const redacted = {};
+		for (const [key, entry] of Object.entries(value)) redacted[key] = isSensitiveErrorDataKey(key) ? "<redacted>" : redactErrorData(entry, depth + 1) ?? null;
+		return redacted;
+	}
+	if (typeof value === "string") return truncateSerializedErrorText(value);
+	if (typeof value === "bigint") return value.toString();
+	if (typeof value === "symbol") return value.description ? `Symbol(${value.description})` : "Symbol()";
+	if (typeof value === "function") return value.name ? `[function ${value.name}]` : "[function]";
+	return "[unserializable]";
+}
+function sanitizeErrorMessage(message) {
+	const htmlStart = message.search(/<html[\s>]/i);
+	return truncateSerializedErrorText((htmlStart >= 0 ? `${message.slice(0, htmlStart).trimEnd()} [HTML response body omitted]` : message).replace(/([?&][^=\s"'<>]*(?:api[_-]?key|authorization|cookie|credential|password|secret|token|tk)[^=\s"'<>]*=)[^&\s"'<>]+/gi, "$1<redacted>"));
+}
+function isSensitiveErrorDataKey(key) {
+	return /api[_-]?key|authorization|cookie|credential|password|secret|token/i.test(key);
+}
+//#endregion
+//#region extensions/codex/src/app-server/plugin-app-cache-key.ts
+/**
+* Builds stable Codex plugin/app inventory cache keys from app-server startup,
+* auth, account, and version inputs without storing secret material.
+*/
+const CODEX_PLUGIN_VERSION = readPluginPackageVersion({ require: createRequire(import.meta.url) });
+/** Builds the full app inventory cache key for Codex plugin/app discovery. */
+function buildCodexPluginAppCacheKey(params) {
+	return buildCodexAppInventoryCacheKey({
+		codexHome: params.runtimeIdentity?.codexHome ?? resolveCodexPluginAppCacheCodexHome(params.appServer, params.agentDir),
+		endpoint: resolveCodexPluginAppCacheEndpoint(params.appServer),
+		authProfileId: params.authProfileId,
+		accountId: params.accountId,
+		envApiKeyFingerprint: params.envApiKeyFingerprint,
+		appServerVersion: params.appServerVersion ?? params.runtimeIdentity?.serverVersion,
+		runtimeIdentity: params.runtimeIdentity
+	}, OPENCLAW_VERSION, CODEX_PLUGIN_VERSION);
+}
+/** Builds a durable thread-binding fingerprint for one initialized app-server runtime. */
+function buildCodexAppServerRuntimeFingerprint(params) {
+	return JSON.stringify({
+		endpoint: resolveCodexPluginAppCacheEndpoint(params.appServer),
+		connectionClass: params.appServer.connectionClass,
+		remoteWorkspaceRoot: params.appServer.remoteWorkspaceRoot ?? null,
+		appServerVersion: params.appServerVersion ?? params.runtimeIdentity?.serverVersion ?? null,
+		runtimeIdentity: params.runtimeIdentity ?? null
+	});
+}
+/** Fingerprints the configured connection that owns a supervised source thread. */
+function buildCodexAppServerConnectionFingerprint(appServer, agentDir) {
+	return JSON.stringify({
+		endpoint: resolveCodexPluginAppCacheEndpoint(appServer),
+		connectionClass: appServer.connectionClass,
+		remoteWorkspaceRoot: appServer.remoteWorkspaceRoot ?? null,
+		homeScope: appServer.start.homeScope ?? null,
+		codexHome: resolveCodexAppServerConnectionHome(appServer.start, agentDir),
+		cwd: appServer.start.cwd ?? null
+	});
+}
+function resolveCodexAppServerConnectionHome(start, agentDir) {
+	const configured = start.env?.CODEX_HOME?.trim();
+	if (configured) return configured;
+	if (start.transport === "unix" && (!start.url || start.url === "unix://")) return resolveCodexAppServerUserHomeDir(start.env ?? process.env);
+	if (start.transport !== "stdio") return null;
+	if (start.homeScope === "user") return resolveCodexAppServerUserHomeDir(process.env);
+	return agentDir ? resolveCodexAppServerHomeDir(agentDir) : null;
+}
+/** Serializes app-server endpoint identity, including credential fingerprints. */
+function resolveCodexPluginAppCacheEndpoint(appServer) {
+	return JSON.stringify({
+		transport: appServer.start.transport,
+		command: appServer.start.command,
+		args: appServer.start.args,
+		url: appServer.start.url ?? null,
+		credentialFingerprint: fingerprintCodexPluginAppCacheCredentials(appServer.start)
+	});
+}
+/** Resolves the CODEX_HOME value that scopes local app-server inventory. */
+function resolveCodexPluginAppCacheCodexHome(appServer, agentDir) {
+	const configuredCodexHome = appServer.start.env?.CODEX_HOME?.trim();
+	if (configuredCodexHome) return configuredCodexHome;
+	return appServer.start.transport === "stdio" && agentDir ? resolveCodexAppServerHomeDir(agentDir) : void 0;
+}
+function fingerprintCodexPluginAppCacheCredentials(startOptions) {
+	const authToken = startOptions.authToken ?? "";
+	const headers = Object.entries(startOptions.headers).map(([key, value]) => [key.toLowerCase(), value]).toSorted(([left], [right]) => left.localeCompare(right));
+	if (!authToken && headers.length === 0) return null;
+	const hash = createHash("sha256");
+	hash.update("openclaw:codex:plugin-app-cache-credentials:v1");
+	hash.update("\0");
+	hash.update(authToken);
+	for (const [key, value] of headers) {
+		hash.update("\0");
+		hash.update(key);
+		hash.update("\0");
+		hash.update(value);
+	}
+	return `sha256:${hash.digest("hex")}`;
+}
+//#endregion
+export { serializeCodexAppInventoryError as a, defaultCodexAppInventoryCache as i, buildCodexAppServerRuntimeFingerprint as n, buildCodexPluginAppCacheKey as r, buildCodexAppServerConnectionFingerprint as t };