@openclaw/codex 2026.7.2-beta.1 → 2026.7.2-beta.3

package/dist/{shared-client-D4mFI9al.js → shared-client-CSXLtCLE.js}

@@ -1,12 +1,11 @@
 import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
-import { a as isRpcResponse, i as isJsonObject$1 } from "./protocol-BMifTfdW.js";
-import { a as codexAppServerStartOptionsKey, f as resolveCodexAppServerRuntimeOptions, h as resolveCodexComputerUseConfig, m as resolveCodexAppServerUserHomeDir, p as resolveCodexAppServerStartOptionsForAgent } from "./config-c48K5HP9.js";
+import { C as resolveCodexComputerUseConfig, S as resolveCodexAppServerUserHomeDir, a as isCodexAppServerNativeAuthProfile, b as resolveCodexAppServerRuntimeOptions, m as codexAppServerStartOptionsKey, x as resolveCodexAppServerStartOptionsForAgent } from "./session-binding-Bmt20HfB.js";
 import { n as resolveCodexAppServerSpawnEnv, t as createStdioTransport } from "./transport-stdio-DXgGZ7Ib.js";
-import { a as isCodexAppServerNativeAuthProfile } from "./session-binding-BMfX1OX-.js";
 import { createRequire } from "node:module";
 import fs, { access } from "node:fs/promises";
 import path from "node:path";
-import { truncateUtf16Safe } from "openclaw/plugin-sdk/text-utility-runtime";
+import { addTimerTimeoutGraceMs, resolveTimerTimeoutMs } from "openclaw/plugin-sdk/number-runtime";
+import { sliceUtf16Safe, truncateUtf16Safe } from "openclaw/plugin-sdk/text-utility-runtime";
 import { createHash, randomUUID } from "node:crypto";
 import fsSync, { constants, existsSync, readFileSync, realpathSync } from "node:fs";
 import os from "node:os";
@@ -24,6 +23,21 @@ import { hasUsableOAuthCredential } from "openclaw/plugin-sdk/provider-auth";
 import { fileURLToPath } from "node:url";
 import { expectDefined } from "openclaw/plugin-sdk/expect-runtime";
 import { withTimeout } from "openclaw/plugin-sdk/security-runtime";
+//#region extensions/codex/src/app-server/protocol.ts
+/** Namespace Codex keeps directly model-visible without exposing it to Code Mode guests. */
+const CODEX_OPENCLAW_DIRECT_DYNAMIC_TOOL_NAMESPACE = "openclaw_direct";
+function flattenCodexDynamicToolFunctions(tools) {
+	return (tools ?? []).flatMap((tool) => tool.type === "namespace" ? tool.tools : [tool]);
+}
+const CODEX_INTERACTIVE_THREAD_SOURCE_KINDS = ["cli", "vscode"];
+const CODEX_INTERACTIVE_CUSTOM_THREAD_SOURCES = ["atlas", "chatgpt"];
+function isJsonObject$1(value) {
+	return Boolean(value && typeof value === "object" && !Array.isArray(value));
+}
+function isRpcResponse(message) {
+	return "id" in message && !("method" in message);
+}
+//#endregion
 //#region extensions/codex/src/app-server/transport-websocket.ts
 /**
 * Adapts a remote Codex app-server WebSocket endpoint to the shared stdio-like
@@ -177,6 +191,8 @@ function signalCodexAppServerTransport(child, signal) {
 */
 /** Minimum Codex app-server version supported by the OpenClaw Codex bridge. */
 const MIN_CODEX_APP_SERVER_VERSION = "0.143.0";
+/** Newest Codex app-server version validated by the OpenClaw Codex bridge. */
+const MAX_CODEX_APP_SERVER_VERSION = "0.144.6";
 /** npm package name for the managed Codex app-server binary. */
 const MANAGED_CODEX_APP_SERVER_PACKAGE = "@openai/codex";
 //#endregion
@@ -191,6 +207,9 @@ const CODEX_APP_SERVER_PARSE_BUFFER_MAX = 8 * 1024 * 1024;
 const CODEX_APP_SERVER_PARSE_BUFFER_MAX_LINES = 1e3;
 const CODEX_DYNAMIC_TOOL_SERVER_REQUEST_TIMEOUT_MS = 6e5;
 const CODEX_APP_SERVER_STDERR_TAIL_MAX = 2e3;
+const CODEX_APP_SERVER_OVERLOADED_ERROR_CODE = -32001;
+const CODEX_APP_SERVER_OVERLOAD_MAX_RETRIES = 3;
+const CODEX_APP_SERVER_OVERLOAD_RETRY_BASE_MS = 50;
 const CODEX_APP_SERVER_CLIENT_INSTANCE_IDS = /* @__PURE__ */ new WeakMap();
 const UNPAIRED_SURROGATE_RE = /[\uD800-\uDBFF](?![\uDC00-\uDFFF])|(?<![\uD800-\uDBFF])[\uDC00-\uDFFF]/g;
 /** Process-local generation fence for bindings tied to one app-server client instance. */
@@ -208,16 +227,31 @@ var CodexAppServerRpcError = class extends Error {
 		this.name = "CodexAppServerRpcError";
 		this.code = error.code;
 		this.data = error.data;
+		this.method = method;
 	}
 };
 var CodexAppServerLocalRequestCancellationError = class extends Error {
 	constructor(method, reason, mayHaveWritten) {
 		super(`${method} ${reason}`);
+		this.reason = reason;
 		this.mayHaveWritten = mayHaveWritten;
 		this.code = "CODEX_APP_SERVER_LOCAL_REQUEST_CANCELLED";
 		this.name = "CodexAppServerLocalRequestCancellationError";
 	}
 };
+function isCodexAppServerRequestTimeoutError(error) {
+	return error instanceof Error && "code" in error && error.code === "CODEX_APP_SERVER_LOCAL_REQUEST_CANCELLED" && "reason" in error && error.reason === "timed out";
+}
+function isCodexAppServerBrokenPipeError(error) {
+	const seen = /* @__PURE__ */ new Set();
+	let current = error;
+	while (current && typeof current === "object" && !seen.has(current)) {
+		seen.add(current);
+		if ("code" in current && current.code === "EPIPE") return true;
+		current = "cause" in current ? current.cause : void 0;
+	}
+	return false;
+}
 var CodexAppServerIndeterminateTransportError = class extends Error {
 	constructor(method, cause) {
 		super(`${method} transport failed after request write: ${cause.message}`, { cause });
@@ -278,8 +312,8 @@ var CodexAppServerClient = class CodexAppServerClient {
 		this.lines.on("line", (line) => this.handleLine(line));
 		this.lines.on("error", (error) => this.closeWithError(error instanceof Error ? error : new Error(String(error))));
 		child.stdout.on("error", (error) => this.closeWithError(error instanceof Error ? error : new Error(String(error))));
-		child.stderr.on("data", (chunk) => {
-			const text = chunk.toString("utf8");
+		child.stderr.setEncoding("utf8");
+		child.stderr.on("data", (text) => {
 			this.stderrTail = appendBoundedTail(this.stderrTail, text, CODEX_APP_SERVER_STDERR_TAIL_MAX);
 			const trimmed = text.trim();
 			if (trimmed) embeddedAgentLog.debug(`codex app-server stderr: ${trimmed}`);
@@ -352,54 +386,101 @@ var CodexAppServerClient = class CodexAppServerClient {
 		if (this.closed) return Promise.reject(this.closeError ?? /* @__PURE__ */ new Error("codex app-server client is closed"));
 		if (options.signal?.aborted) return Promise.reject(new CodexAppServerLocalRequestCancellationError(method, "aborted", false));
 		const guard = method === "thread/start" || method === "thread/resume" || method === "thread/fork" ? this.threadSessionRequestGuard : void 0;
-		if (guard) return (async () => {
-			const guardStartedAt = Date.now();
-			const timeoutMessage = `${method} timed out`;
-			const abortMessage = `${method} aborted`;
-			let releaseGuard;
-			try {
-				releaseGuard = await guard({
-					signal: options.signal,
-					timeoutMs: options.timeoutMs,
-					timeoutMessage,
-					abortMessage
-				});
-			} catch (error) {
-				if (error instanceof Error && error.message === timeoutMessage) throw new CodexAppServerLocalRequestCancellationError(method, "timed out", false);
-				if (error instanceof Error && error.message === abortMessage) throw new CodexAppServerLocalRequestCancellationError(method, "aborted", false);
-				throw error;
-			}
-			let released = false;
-			const release = () => {
-				if (released) return;
-				released = true;
-				releaseGuard();
-			};
-			let releaseWhenRequestSettles = true;
-			let requestMayHaveWritten = false;
+		if (guard) {
+			if (!options.signal && !(options.timeoutMs !== void 0 && Number.isFinite(options.timeoutMs) && options.timeoutMs > 0)) return Promise.reject(/* @__PURE__ */ new TypeError(`${method} requires a positive finite timeout or abort signal`));
+			return (async () => {
+				const guardStartedAt = Date.now();
+				const timeoutMessage = `${method} timed out`;
+				const abortMessage = `${method} aborted`;
+				let releaseGuard;
+				try {
+					releaseGuard = await guard({
+						signal: options.signal,
+						timeoutMs: options.timeoutMs,
+						timeoutMessage,
+						abortMessage
+					});
+				} catch (error) {
+					if (error instanceof Error && error.message === timeoutMessage) throw new CodexAppServerLocalRequestCancellationError(method, "timed out", false);
+					if (error instanceof Error && error.message === abortMessage) throw new CodexAppServerLocalRequestCancellationError(method, "aborted", false);
+					throw error;
+				}
+				let released = false;
+				const release = () => {
+					if (released) return;
+					released = true;
+					releaseGuard();
+				};
+				let releaseWhenRequestSettles = true;
+				let requestMayHaveWritten = false;
+				try {
+					const elapsedMs = Date.now() - guardStartedAt;
+					const remainingTimeoutMs = options.timeoutMs === void 0 ? void 0 : options.timeoutMs - elapsedMs;
+					if (remainingTimeoutMs !== void 0 && remainingTimeoutMs <= 0) throw new CodexAppServerLocalRequestCancellationError(method, "timed out", false);
+					return await this.requestWithoutThreadSessionGuard(method, params, {
+						...options,
+						...remainingTimeoutMs !== void 0 ? { timeoutMs: remainingTimeoutMs } : {}
+					}, () => {
+						requestMayHaveWritten = true;
+					});
+				} catch (error) {
+					if (requestMayHaveWritten && !(error instanceof CodexAppServerRpcError)) {
+						releaseWhenRequestSettles = false;
+						await this.closeAndRunAfterExit(release, method);
+					}
+					throw error;
+				} finally {
+					if (releaseWhenRequestSettles) release();
+				}
+			})();
+		}
+		return this.requestWithoutThreadSessionGuard(method, params, options);
+	}
+	requestWithoutThreadSessionGuard(method, params, options, onWriteAttempt) {
+		return this.requestWithOverloadRetry(method, params, options, onWriteAttempt);
+	}
+	async requestWithOverloadRetry(method, params, options, onWriteAttempt) {
+		const deadline = options.timeoutMs !== void 0 && Number.isFinite(options.timeoutMs) ? Date.now() + options.timeoutMs : void 0;
+		for (let retry = 0;; retry += 1) {
+			if (options.signal?.aborted) throw new CodexAppServerLocalRequestCancellationError(method, "aborted", false);
+			const remainingTimeoutMs = deadline === void 0 ? void 0 : deadline - Date.now();
+			if (remainingTimeoutMs !== void 0 && remainingTimeoutMs <= 0) throw new CodexAppServerLocalRequestCancellationError(method, "timed out", false);
 			try {
-				const elapsedMs = Date.now() - guardStartedAt;
-				const remainingTimeoutMs = options.timeoutMs === void 0 ? void 0 : options.timeoutMs - elapsedMs;
-				if (remainingTimeoutMs !== void 0 && remainingTimeoutMs <= 0) throw new CodexAppServerLocalRequestCancellationError(method, "timed out", false);
-				return await this.requestWithoutThreadSessionGuard(method, params, {
+				return await this.requestOnce(method, params, {
 					...options,
 					...remainingTimeoutMs !== void 0 ? { timeoutMs: remainingTimeoutMs } : {}
-				}, () => {
-					requestMayHaveWritten = true;
-				});
+				}, onWriteAttempt);
 			} catch (error) {
-				if (requestMayHaveWritten && !(error instanceof CodexAppServerRpcError)) {
-					releaseWhenRequestSettles = false;
-					await this.closeAndRunAfterExit(release, method);
-				}
-				throw error;
-			} finally {
-				if (releaseWhenRequestSettles) release();
+				if (!(error instanceof CodexAppServerRpcError) || error.code !== CODEX_APP_SERVER_OVERLOADED_ERROR_CODE || retry >= CODEX_APP_SERVER_OVERLOAD_MAX_RETRIES) throw error;
+				const backoffMs = Math.round(CODEX_APP_SERVER_OVERLOAD_RETRY_BASE_MS * 2 ** retry * (.75 + Math.random() * .5));
+				await this.waitForOverloadRetry(method, backoffMs, deadline, options.signal);
 			}
-		})();
-		return this.requestWithoutThreadSessionGuard(method, params, options);
+		}
 	}
-	requestWithoutThreadSessionGuard(method, params, options, onWriteAttempt) {
+	async waitForOverloadRetry(method, backoffMs, deadline, signal) {
+		if (signal?.aborted) throw new CodexAppServerLocalRequestCancellationError(method, "aborted", false);
+		const remainingMs = deadline === void 0 ? void 0 : deadline - Date.now();
+		if (remainingMs !== void 0 && remainingMs <= 0) throw new CodexAppServerLocalRequestCancellationError(method, "timed out", false);
+		const delayMs = remainingMs === void 0 ? backoffMs : Math.min(backoffMs, remainingMs);
+		await new Promise((resolve, reject) => {
+			const timer = setTimeout(() => {
+				cleanup();
+				resolve();
+			}, delayMs);
+			timer.unref?.();
+			const abortListener = () => {
+				cleanup();
+				reject(new CodexAppServerLocalRequestCancellationError(method, "aborted", false));
+			};
+			const cleanup = () => {
+				clearTimeout(timer);
+				signal?.removeEventListener("abort", abortListener);
+			};
+			signal?.addEventListener("abort", abortListener, { once: true });
+			if (signal?.aborted) abortListener();
+		});
+	}
+	requestOnce(method, params, options, onWriteAttempt) {
 		if (this.closed) return Promise.reject(this.closeError ?? /* @__PURE__ */ new Error("codex app-server client is closed"));
 		if (options.signal?.aborted) return Promise.reject(new CodexAppServerLocalRequestCancellationError(method, "aborted", false));
 		const id = this.nextId++;
@@ -727,7 +808,7 @@ function timeoutServerRequestResponse(request) {
 var CodexAppServerVersionError = class extends Error {
 	constructor(detectedVersion) {
 		const detected = detectedVersion ? `detected ${detectedVersion}` : "OpenClaw could not determine the running Codex version";
-		super(`Codex app-server ${MIN_CODEX_APP_SERVER_VERSION} or newer is required, but ${detected}. Update the configured Codex app-server binary, or remove custom command overrides to use the managed binary.`);
+		super(`A stable Codex app-server from ${MIN_CODEX_APP_SERVER_VERSION} through ${MAX_CODEX_APP_SERVER_VERSION} is required, but ${detected}. Update the configured Codex app-server binary, or remove custom command overrides to use the managed binary.`);
 		this.name = "CodexAppServerVersionError";
 		this.detectedVersion = detectedVersion;
 	}
@@ -735,7 +816,7 @@ var CodexAppServerVersionError = class extends Error {
 function assertSupportedCodexAppServerVersion(response) {
 	const detectedVersion = readCodexVersionFromUserAgent(response.userAgent);
 	const parsedVersion = parse(detectedVersion ?? "");
-	if (!detectedVersion || !parsedVersion || parsedVersion.compare("0.143.0") < 0 || parsedVersion.version === "0.143.0" && parsedVersion.build.length > 0) throw new CodexAppServerVersionError(detectedVersion);
+	if (!detectedVersion || !parsedVersion || parsedVersion.compare("0.143.0") < 0 || parsedVersion.compare("0.144.6") > 0 || parsedVersion.prerelease.length > 0 || parsedVersion.build.length > 0) throw new CodexAppServerVersionError(detectedVersion);
 	return detectedVersion;
 }
 function isUnsupportedCodexAppServerVersionError(error) {
@@ -768,7 +849,7 @@ function redactCodexAppServerLinePreview(value) {
 }
 function appendBoundedTail(current, next, maxLength) {
 	const combined = `${current}${next}`;
-	return combined.length > maxLength ? combined.slice(combined.length - maxLength) : combined;
+	return combined.length > maxLength ? sliceUtf16Safe(combined, -maxLength) : combined;
 }
 function buildCodexAppServerExitError(code, signal, stderrTail) {
 	const stderrPreview = redactCodexAppServerLinePreview(stderrTail);
@@ -806,6 +887,103 @@ function formatExitValue(value) {
 	return "unknown";
 }
 //#endregion
+//#region extensions/codex/src/app-server/attempt-timeouts.ts
+/**
+* Timeout defaults and normalizers for Codex app-server startup and turn
+* liveness watches.
+*/
+/** Minimum startup timeout accepted by the Codex app-server harness. */
+const CODEX_APP_SERVER_STARTUP_TIMEOUT_FLOOR_MS = 100;
+/** Default idle timeout while waiting for app-server turn completion. */
+const CODEX_TURN_COMPLETION_IDLE_TIMEOUT_MS = 6e4;
+/** Short guard after apparent assistant completion. */
+const CODEX_TURN_ASSISTANT_COMPLETION_IDLE_TIMEOUT_MS = 1e4;
+const CODEX_POST_TOOL_RAW_ASSISTANT_COMPLETION_IDLE_TIMEOUT_MS = 5 * 6e4;
+/** Guard after reasoning/commentary progress when no tool handoff occurred. */
+const CODEX_POST_REASONING_REPLY_IDLE_TIMEOUT_MS = 5 * 6e4;
+/** Long terminal idle watch for app-server turns that never send completion. */
+const CODEX_TURN_TERMINAL_IDLE_TIMEOUT_MS = 30 * 6e4;
+var CodexAppServerStartupError = class extends Error {
+	constructor(reason, message = reason === "timed_out" ? "codex app-server startup timed out" : "codex app-server startup aborted") {
+		super(message);
+		this.reason = reason;
+		this.code = "CODEX_APP_SERVER_STARTUP_CANCELLED";
+		this.name = "CodexAppServerStartupError";
+	}
+};
+function isCodexAppServerStartupError(error, reason) {
+	return error instanceof Error && "code" in error && error.code === "CODEX_APP_SERVER_STARTUP_CANCELLED" && "reason" in error && (error.reason === "aborted" || error.reason === "timed_out") && (reason === void 0 || error.reason === reason);
+}
+function resolvePositiveIntegerTimeoutMs(value, fallbackMs) {
+	return resolveTimerTimeoutMs(value, resolveTimerTimeoutMs(fallbackMs, 1));
+}
+/** Runs startup work with abort and timeout handling plus optional cleanup. */
+async function withCodexStartupTimeout(params) {
+	if (params.signal.aborted) throw new CodexAppServerStartupError("aborted");
+	let timeout;
+	let abortCleanup;
+	let timeoutError;
+	let timeoutCleanup;
+	try {
+		return await Promise.race([params.operation(), new Promise((_, reject) => {
+			const rejectOnce = (error) => {
+				if (timeout) {
+					clearTimeout(timeout);
+					timeout = void 0;
+				}
+				reject(error);
+			};
+			timeout = setTimeout(() => {
+				timeoutError = new CodexAppServerStartupError("timed_out");
+				timeoutCleanup = Promise.resolve(params.onTimeout?.()).then(() => void 0, () => void 0);
+				timeoutCleanup.finally(() => {
+					rejectOnce(timeoutError);
+				});
+			}, params.timeoutMs);
+			const abortListener = () => rejectOnce(new CodexAppServerStartupError("aborted"));
+			params.signal.addEventListener("abort", abortListener, { once: true });
+			abortCleanup = () => params.signal.removeEventListener("abort", abortListener);
+		})]);
+	} catch (error) {
+		if (timeoutError) {
+			await timeoutCleanup;
+			throw timeoutError;
+		}
+		throw error;
+	} finally {
+		if (timeout) clearTimeout(timeout);
+		abortCleanup?.();
+	}
+}
+/** Resolves startup timeout while honoring the configured floor. */
+function resolveCodexStartupTimeoutMs(params) {
+	const timeoutFloorMs = resolvePositiveIntegerTimeoutMs(params.timeoutFloorMs, CODEX_APP_SERVER_STARTUP_TIMEOUT_FLOOR_MS);
+	const timeoutMs = resolvePositiveIntegerTimeoutMs(params.timeoutMs, timeoutFloorMs);
+	return Math.max(timeoutFloorMs, timeoutMs);
+}
+/** Resolves the completion-idle timeout for an active turn. */
+function resolveCodexTurnCompletionIdleTimeoutMs(value) {
+	return resolvePositiveIntegerTimeoutMs(value, CODEX_TURN_COMPLETION_IDLE_TIMEOUT_MS);
+}
+/** Resolves the short assistant-completion release timeout. */
+function resolveCodexTurnAssistantCompletionIdleTimeoutMs(value) {
+	return resolvePositiveIntegerTimeoutMs(value, CODEX_TURN_ASSISTANT_COMPLETION_IDLE_TIMEOUT_MS);
+}
+/** Resolves the conservative post-tool raw assistant guard timeout. */
+function resolveCodexPostToolRawAssistantCompletionIdleTimeoutMs(value, fallbackMs) {
+	return resolvePositiveIntegerTimeoutMs(value, Math.max(resolvePositiveIntegerTimeoutMs(void 0, fallbackMs), CODEX_POST_TOOL_RAW_ASSISTANT_COMPLETION_IDLE_TIMEOUT_MS));
+}
+/** Resolves the long terminal turn idle timeout. */
+function resolveCodexTurnTerminalIdleTimeoutMs(value, runTimeoutOverrideMs) {
+	const explicitRunBudgetMs = resolvePositiveIntegerTimeoutMs(runTimeoutOverrideMs, CODEX_TURN_TERMINAL_IDLE_TIMEOUT_MS);
+	return resolvePositiveIntegerTimeoutMs(value, Math.max(CODEX_TURN_TERMINAL_IDLE_TIMEOUT_MS, explicitRunBudgetMs));
+}
+/** Adds gateway grace time to a caller timeout without overflowing invalid values. */
+function resolveCodexGatewayTimeoutWithGraceMs(timeoutMs, graceMs = 1e4) {
+	const timeout = resolvePositiveIntegerTimeoutMs(timeoutMs, 1);
+	return addTimerTimeoutGraceMs(timeout, resolveTimerTimeoutMs(graceMs, 0, 0)) ?? timeout;
+}
+//#endregion
 //#region extensions/codex/src/app-server/auth-start-options.ts
 const CODEX_APP_SERVER_HOME_DIRNAME = "codex-home";
 const CODEX_EPHEMERAL_AUTH_STORE_OVERRIDE = "cli_auth_credentials_store=\"ephemeral\"";
@@ -1080,14 +1258,14 @@ async function resolveCodexAppServerPreparedAuthHandoff(params) {
 		authProfileId,
 		nativeAuthProfile
 	};
-	if (!authProfileId || !nativeAuthProfile) throw new Error(params.subscriptionProfileRequiredError);
+	if (!authProfileId || !nativeAuthProfile) throw createCodexAppServerAuthError(params.subscriptionProfileRequiredError);
 	const snapshot = await resolveCodexAppServerPreparedAuthProfileSnapshot({
 		authProfileId,
 		authProfileStore: params.authProfileStore,
 		agentDir: params.agentDir,
 		config: params.config
 	});
-	if (!snapshot) throw new Error(params.subscriptionProfileUnusableError);
+	if (!snapshot) throw createCodexAppServerAuthError(params.subscriptionProfileUnusableError);
 	return {
 		authProfileId,
 		nativeAuthProfile,
@@ -1215,15 +1393,29 @@ async function applyCodexAppServerAuthProfile(params) {
 		});
 		return;
 	}
-	if (params.authProfileId === null) return;
-	const loginParams = await resolveCodexAppServerAuthProfileLoginParams({
-		agentDir: params.agentDir,
-		authProfileId: params.authProfileId,
-		authProfileStore: params.authProfileStore,
-		config: params.config
-	});
+	if (params.authProfileId === null) {
+		if (params.authRequirement === "subscription") {
+			const response = await params.client.request("account/read", { refreshToken: false });
+			if (!isJsonObject$1(response.account) || response.account.type !== "chatgpt") throw createCodexAppServerAuthError("Codex subscription auth profile could not produce login credentials.");
+		}
+		return;
+	}
+	let loginParams;
+	try {
+		loginParams = await resolveCodexAppServerAuthProfileLoginParams({
+			agentDir: params.agentDir,
+			authProfileId: params.authProfileId,
+			authProfileStore: params.authProfileStore,
+			config: params.config
+		});
+	} catch (error) {
+		if (params.authRequirement === "subscription" && error instanceof CodexAppServerAuthProfileUnavailableError) throw createCodexAppServerAuthError("Codex subscription auth profile could not produce login credentials.", error);
+		throw error;
+	}
+	if (params.authRequirement === "subscription" && loginParams?.type !== "chatgptAuthTokens") throw createCodexAppServerAuthError("Codex subscription auth profile could not produce login credentials.");
 	if (!loginParams) {
-		if (params.startOptions?.transport !== "stdio") return;
+		if (params.authRequirement === "subscription") throw createCodexAppServerAuthError("Codex subscription auth profile could not produce login credentials.");
+		if (params.authRequirement !== "api-key" || params.startOptions?.transport !== "stdio") return;
 		const env = resolveCodexAppServerSpawnEnv(params.startOptions, process.env);
 		const fallbackLoginParams = await resolveCodexAppServerFallbackApiKeyLoginParams({
 			client: params.client,
@@ -1235,8 +1427,25 @@ async function applyCodexAppServerAuthProfile(params) {
 	}
 	await params.client.request("account/login/start", loginParams);
 }
-function resolveCodexAppServerAuthProfileLoginParams(params) {
-	return resolveCodexAppServerAuthProfileLoginParamsInternal(params);
+function createCodexAppServerAuthError(message, cause) {
+	const error = cause === void 0 ? new Error(message) : new Error(message, { cause });
+	return Object.assign(error, { status: 401 });
+}
+var CodexAppServerAuthProfileUnavailableError = class extends Error {};
+async function resolveCodexAppServerAuthProfileLoginParams(params) {
+	const store = resolveCodexAppServerAuthProfileStore(params);
+	const profileId = resolveCodexAppServerAuthProfileId({
+		authProfileId: params.authProfileId,
+		store,
+		config: params.config
+	});
+	const profile = profileId ? store.profiles[profileId] : void 0;
+	if (profileId && !profile) throw new CodexAppServerAuthProfileUnavailableError(`Codex app-server auth profile "${profileId}" was not found.`);
+	if (profileId && profile && !isCodexAppServerAuthProfileCredential(profile, params.config)) throw new CodexAppServerAuthProfileUnavailableError(`Codex app-server auth profile "${profileId}" must be OpenAI Codex auth or an OpenAI API-key backup.`);
+	return await resolveCodexAppServerAuthProfileLoginParamsInternal({
+		...params,
+		authProfileStore: store
+	});
 }
 async function refreshCodexAppServerAuthTokens(params) {
 	const loginParams = await resolveCodexAppServerAuthProfileLoginParamsInternal({
@@ -1273,7 +1482,7 @@ async function resolveCodexAppServerAuthProfileLoginParamsInternal(params) {
 		forceOAuthRefresh: params.forceOAuthRefresh === true,
 		config: params.config
 	});
-	if (!loginParams) throw new Error(`Codex app-server auth profile "${profileId}" does not contain usable credentials.`);
+	if (!loginParams) throw new CodexAppServerAuthProfileUnavailableError(`Codex app-server auth profile "${profileId}" does not contain usable credentials.`);
 	return loginParams;
 }
 async function resolveCodexAppServerFallbackApiKeyLoginParams(params) {
@@ -1903,8 +2112,11 @@ async function waitForPreviousFence(previous, options) {
 * runtime timeout helper.
 */
 /** Awaits a promise with a Codex-specific timeout error message. */
-async function withTimeout$1(promise, timeoutMs, timeoutMessage) {
-	return await withTimeout(promise, timeoutMs, { message: timeoutMessage });
+async function withTimeout$1(promise, timeoutMs, timeoutMessage, createError) {
+	return await withTimeout(promise, timeoutMs, {
+		message: timeoutMessage,
+		...createError ? { createError } : {}
+	});
 }
 //#endregion
 //#region extensions/codex/src/app-server/shared-client.ts
@@ -1913,7 +2125,6 @@ async function withTimeout$1(promise, timeoutMs, timeoutMessage) {
 * lease tracking, and teardown.
 */
 var shared_client_exports = /* @__PURE__ */ __exportAll({
-	CodexAppServerStartSelectionChangedError: () => CodexAppServerStartSelectionChangedError,
 	assertCodexAppServerClientStartSelectionCurrent: () => assertCodexAppServerClientStartSelectionCurrent,
 	clearSharedCodexAppServerClientAndWait: () => clearSharedCodexAppServerClientAndWait,
 	clearSharedCodexAppServerClientIfCurrent: () => clearSharedCodexAppServerClientIfCurrent,
@@ -1995,6 +2206,10 @@ function resolveCodexNativeConfigFenceKey(params) {
 	const codexHome = configuredHome ? configuredHome : startOptions.homeScope === "user" ? resolveCodexAppServerUserHomeDir() : agentDir ? resolveCodexAppServerHomeDir(agentDir) : void 0;
 	return codexHome ? `codex-home:${path.resolve(codexHome)}` : void 0;
 }
+function inferAuthRequirement(preparedAuth) {
+	if (preparedAuth?.kind === "api-key") return "api-key";
+	return preparedAuth?.kind === "profile" ? "subscription" : void 0;
+}
 async function resolveCodexAppServerClientStartContext(options) {
 	const agentDir = options?.agentDir ?? resolveDefaultAgentDir(options?.config ?? {});
 	const requestedStartOptions = options?.startOptions ?? resolveCodexAppServerRuntimeOptions().start;
@@ -2004,6 +2219,9 @@ async function resolveCodexAppServerClientStartContext(options) {
 	if (preparedAuth?.kind === "profile" && !preparedAuth.store.profiles[preparedAuth.profileId]) throw new Error(`Prepared Codex auth profile "${preparedAuth.profileId}" was not found.`);
 	if (preparedAuth?.kind === "api-key" && !preparedApiKey) throw new Error("Prepared Codex API-key auth is missing its resolved key.");
 	if (preparedAuth && requestedStartOptions.homeScope === "user") throw new Error("Prepared Codex auth requires an isolated app-server home.");
+	const preparedAuthRequirement = inferAuthRequirement(preparedAuth);
+	if (options?.authRequirement && preparedAuthRequirement && options.authRequirement !== preparedAuthRequirement) throw new Error("Prepared Codex auth does not satisfy the requested auth requirement.");
+	const authRequirement = options?.authRequirement ?? preparedAuthRequirement;
 	const usesNativeAuth = !preparedAuth && (options?.authProfileId === null || requestedStartOptions.homeScope === "user");
 	const requestedAuthProfileId = preparedAuth?.kind === "profile" ? preparedAuth.profileId : options?.authProfileId ?? void 0;
 	const authProfileStore = preparedAuth?.kind === "profile" ? preparedAuth.store : !usesNativeAuth && options?.authProfileStore ? resolveCodexAppServerAuthProfileStore({
@@ -2039,6 +2257,7 @@ async function resolveCodexAppServerClientStartContext(options) {
 		authProfileStore,
 		requestedStartOptions,
 		preparedAuth: resolvedPreparedAuth,
+		authRequirement,
 		startOptions: await bridgeCodexAppServerStartOptions({
 			startOptions: await resolveManagedCodexAppServerStartOptions(resolveCodexAppServerStartOptionsForAgent({
 				startOptions: requestedStartOptions,
@@ -2087,9 +2306,9 @@ async function withLeasedCodexAppServerClientStartSelectionRetry(params) {
 	const deadline = Date.now() + timeoutMs;
 	const signal = params.signal ?? params.options?.abandonSignal;
 	const requestOptions = () => {
-		if (signal?.aborted) throw new Error("Codex app-server selection retry aborted");
+		if (signal?.aborted) throw new CodexAppServerStartupError("aborted", "Codex app-server selection retry aborted");
 		const remainingTimeoutMs = deadline - Date.now();
-		if (remainingTimeoutMs <= 0) throw new Error("Codex app-server selection retry timed out");
+		if (remainingTimeoutMs <= 0) throw new CodexAppServerStartupError("timed_out", "Codex app-server selection retry timed out");
 		return {
 			timeoutMs: remainingTimeoutMs,
 			...signal ? { signal } : {}
@@ -2117,18 +2336,18 @@ async function withLeasedCodexAppServerClientStartSelectionRetry(params) {
 	throw new Error("Codex app-server selection retry loop exited unexpectedly");
 }
 async function acquireSharedCodexAppServerClient(options, leaseOptions) {
-	if (options?.abandonSignal?.aborted) throw new Error("codex app-server initialize aborted");
+	if (options?.abandonSignal?.aborted) throw new CodexAppServerStartupError("aborted", "codex app-server initialize aborted");
 	const acquireStartedAt = Date.now();
 	const timeoutMs = options?.timeoutMs ?? 0;
-	const { agentDir, usesNativeAuth, authProfileId, authProfileStore, preparedAuth, requestedStartOptions, startOptions } = await withCodexAppServerAcquireDeadline(timeoutMs, resolveCodexAppServerClientStartContext(options), options?.abandonSignal);
+	const { agentDir, usesNativeAuth, authProfileId, authProfileStore, preparedAuth, authRequirement, requestedStartOptions, startOptions } = await withCodexAppServerAcquireDeadline(timeoutMs, resolveCodexAppServerClientStartContext(options), options?.abandonSignal);
 	const remainingTimeoutMs = resolveRemainingAcquireTimeout(timeoutMs, acquireStartedAt);
-	const authIdentityCacheKey = preparedAuth?.kind === "api-key" ? resolveCodexAppServerPreparedApiKeyCacheKey(preparedAuth.apiKey) : preparedAuth?.snapshot.secretFreeCacheKey ?? (authProfileId ? void 0 : resolveCodexAppServerFallbackApiKeyCacheKey({ startOptions }));
-	const baseKey = codexAppServerStartOptionsKey(startOptions, {
+	const authIdentityCacheKey = preparedAuth?.kind === "api-key" ? resolveCodexAppServerPreparedApiKeyCacheKey(preparedAuth.apiKey) : preparedAuth?.snapshot.secretFreeCacheKey ?? (authRequirement === "api-key" && !authProfileId ? resolveCodexAppServerFallbackApiKeyCacheKey({ startOptions }) : void 0);
+	const baseKey = `${codexAppServerStartOptionsKey(startOptions, {
 		authProfileId,
 		authBindingFingerprint: options?.authBindingFingerprint,
 		agentDir: usesNativeAuth ? void 0 : agentDir,
 		fallbackApiKeyCacheKey: authIdentityCacheKey
-	});
+	})}\0auth-requirement:${authRequirement ?? "native"}`;
 	const runtimeArtifactMode = options?.runtimeArtifactMode ?? (options?.expectedRuntimeArtifact ? "capture" : void 0);
 	const expectedRuntimeArtifactKey = options?.expectedRuntimeArtifact ? createHash("sha256").update(options.expectedRuntimeArtifact.id).update("\0").update(options.expectedRuntimeArtifact.fingerprint).digest("hex") : "mint";
 	const key = runtimeArtifactMode ? `${baseKey}\0runtime-artifact:capture-v1:${expectedRuntimeArtifactKey}` : baseKey;
@@ -2164,6 +2383,7 @@ async function acquireSharedCodexAppServerClient(options, leaseOptions) {
 		authProfileId: usesNativeAuth || preparedAuth?.kind === "api-key" ? null : authProfileId,
 		authProfileStore,
 		preparedAuth,
+		authRequirement,
 		runtimeArtifactMode,
 		...options?.expectedRuntimeArtifact ? { expectedRuntimeArtifact: options.expectedRuntimeArtifact } : {},
 		runtimeArtifactSignal: entry.runtimeArtifactStartupAbort?.signal,
@@ -2196,11 +2416,11 @@ async function acquireSharedCodexAppServerClient(options, leaseOptions) {
 	}
 }
 async function withCodexAppServerAcquireDeadline(timeoutMs, promise, signal, timeoutMessage = "codex app-server initialize timed out") {
-	if (signal?.aborted) throw new Error("codex app-server initialize aborted");
-	const timed = withTimeout$1(promise, timeoutMs, timeoutMessage);
+	if (signal?.aborted) throw new CodexAppServerStartupError("aborted", "codex app-server initialize aborted");
+	const timed = withTimeout$1(promise, timeoutMs, timeoutMessage, () => new CodexAppServerStartupError("timed_out", timeoutMessage));
 	if (!signal) return await timed;
 	return await new Promise((resolve, reject) => {
-		const onAbort = () => reject(/* @__PURE__ */ new Error("codex app-server initialize aborted"));
+		const onAbort = () => reject(new CodexAppServerStartupError("aborted", "codex app-server initialize aborted"));
 		signal.addEventListener("abort", onAbort, { once: true });
 		timed.then(resolve, reject).finally(() => signal.removeEventListener("abort", onAbort));
 	});
@@ -2208,7 +2428,7 @@ async function withCodexAppServerAcquireDeadline(timeoutMs, promise, signal, tim
 function resolveRemainingAcquireTimeout(timeoutMs, startedAt) {
 	if (!(timeoutMs > 0)) return timeoutMs;
 	const remaining = timeoutMs - (Date.now() - startedAt);
-	if (remaining <= 0) throw new Error("codex app-server initialize timed out");
+	if (remaining <= 0) throw new CodexAppServerStartupError("timed_out", "codex app-server initialize timed out");
 	return remaining;
 }
 function createSharedCodexAppServerClientStartup(params) {
@@ -2220,6 +2440,7 @@ function createSharedCodexAppServerClientStartup(params) {
 		authProfileId: params.authProfileId,
 		authProfileStore: params.authProfileStore,
 		preparedAuth: params.preparedAuth,
+		authRequirement: params.authRequirement,
 		runtimeArtifactMode: params.runtimeArtifactMode,
 		...params.expectedRuntimeArtifact ? { expectedRuntimeArtifact: params.expectedRuntimeArtifact } : {},
 		runtimeArtifactSignal: params.runtimeArtifactSignal,
@@ -2246,10 +2467,10 @@ function createSharedCodexAppServerClientStartup(params) {
 }
 /** Starts a non-shared Codex app-server client owned entirely by the caller. */
 async function createIsolatedCodexAppServerClient(options) {
-	if (options?.abandonSignal?.aborted) throw new Error("codex app-server initialize aborted");
+	if (options?.abandonSignal?.aborted) throw new CodexAppServerStartupError("aborted", "codex app-server initialize aborted");
 	const acquireStartedAt = Date.now();
 	const timeoutMs = options?.timeoutMs ?? 0;
-	const { agentDir, usesNativeAuth, authProfileId, authProfileStore, preparedAuth, requestedStartOptions, startOptions } = await withCodexAppServerAcquireDeadline(timeoutMs, resolveCodexAppServerClientStartContext(options), options?.abandonSignal);
+	const { agentDir, usesNativeAuth, authProfileId, authProfileStore, preparedAuth, authRequirement, requestedStartOptions, startOptions } = await withCodexAppServerAcquireDeadline(timeoutMs, resolveCodexAppServerClientStartContext(options), options?.abandonSignal);
 	return await startInitializedCodexAppServerClient({
 		requestedStartOptions,
 		startOptions,
@@ -2257,6 +2478,7 @@ async function createIsolatedCodexAppServerClient(options) {
 		authProfileId: usesNativeAuth || preparedAuth?.kind === "api-key" ? null : authProfileId,
 		authProfileStore,
 		preparedAuth,
+		authRequirement,
 		runtimeArtifactMode: options?.runtimeArtifactMode ?? (options?.expectedRuntimeArtifact ? "capture" : void 0),
 		...options?.expectedRuntimeArtifact ? { expectedRuntimeArtifact: options.expectedRuntimeArtifact } : {},
 		runtimeArtifactSignal: options?.abandonSignal,
@@ -2324,6 +2546,7 @@ async function startInitializedCodexAppServerClient(params) {
 				agentDir: params.agentDir,
 				authProfileId: params.authProfileId,
 				preparedAuth: params.preparedAuth,
+				authRequirement: params.authRequirement,
 				startOptions,
 				config: params.config,
 				...params.authProfileStore ? { authProfileStore: params.authProfileStore } : {}
@@ -2550,4 +2773,4 @@ function collectSharedClients(state) {
 	return [...new Set([...state.clients.values()].map((entry) => entry.client).filter((client) => Boolean(client)))];
 }
 //#endregion
-export { isCodexAppServerApprovalRequest as A, resolveCodexAppServerFallbackApiKeyCacheKey as C, resolveCodexAppServerHomeDir as D, resolveFirstExistingMacOSDesktopCodexBundledMarketplacePath as E, isCodexAppServerIndeterminateRequestCancellationError as M, isCodexAppServerIndeterminateTransportError as N, CodexAppServerRpcError as O, isCodexAppServerPrewriteRequestCancellationError as P, resolveCodexAppServerAuthProfileIdForAgent as S, resolveCodexAppServerPreparedAuthHandoff as T, readCodexRateLimitsRevision as _, getLeasedSharedCodexAppServerClient as a, resolveCodexAppServerAuthAccountCacheKey as b, releaseLeasedSharedCodexAppServerClient as c, retireSharedCodexAppServerClientIfCurrent as d, shared_client_exports as f, ensureCodexAppServerClientRuntime as g, acquireCodexNativeConfigFence as h, createIsolatedCodexAppServerClient as i, isCodexAppServerConnectionClosedError as j, getCodexAppServerClientInstanceId as k, resolveCodexNativeConfigFenceKey as l, withTimeout$1 as m, clearSharedCodexAppServerClientIfCurrentAndUnclaimed as n, isCodexAppServerStartSelectionChangedError as o, withLeasedCodexAppServerClientStartSelectionRetry as p, clearSharedCodexAppServerClientIfCurrentAndWait as r, releaseCodexAppServerClientLease as s, clearSharedCodexAppServerClientIfCurrent as t, retainSharedCodexAppServerClientIfCurrent as u, readRecentCodexRateLimits as v, resolveCodexAppServerPreparedApiKeyCacheKey as w, resolveCodexAppServerAuthProfileId as x, rememberCodexRateLimitsRead as y };
+export { isCodexAppServerStartupError as A, isCodexAppServerApprovalRequest as B, resolveCodexAppServerFallbackApiKeyCacheKey as C, resolveCodexAppServerHomeDir as D, resolveFirstExistingMacOSDesktopCodexBundledMarketplacePath as E, resolveCodexTurnCompletionIdleTimeoutMs as F, isCodexAppServerPrewriteRequestCancellationError as G, isCodexAppServerConnectionClosedError as H, resolveCodexTurnTerminalIdleTimeoutMs as I, CODEX_INTERACTIVE_THREAD_SOURCE_KINDS as J, isCodexAppServerRequestTimeoutError as K, withCodexStartupTimeout as L, resolveCodexPostToolRawAssistantCompletionIdleTimeoutMs as M, resolveCodexStartupTimeoutMs as N, CODEX_POST_REASONING_REPLY_IDLE_TIMEOUT_MS as O, resolveCodexTurnAssistantCompletionIdleTimeoutMs as P, CodexAppServerRpcError as R, resolveCodexAppServerAuthProfileIdForAgent as S, resolveCodexAppServerPreparedAuthHandoff as T, isCodexAppServerIndeterminateRequestCancellationError as U, isCodexAppServerBrokenPipeError as V, isCodexAppServerIndeterminateTransportError as W, flattenCodexDynamicToolFunctions as X, CODEX_OPENCLAW_DIRECT_DYNAMIC_TOOL_NAMESPACE as Y, isJsonObject$1 as Z, readCodexRateLimitsRevision as _, getLeasedSharedCodexAppServerClient as a, resolveCodexAppServerAuthAccountCacheKey as b, releaseLeasedSharedCodexAppServerClient as c, retireSharedCodexAppServerClientIfCurrent as d, shared_client_exports as f, ensureCodexAppServerClientRuntime as g, acquireCodexNativeConfigFence as h, createIsolatedCodexAppServerClient as i, resolveCodexGatewayTimeoutWithGraceMs as j, CodexAppServerStartupError as k, resolveCodexNativeConfigFenceKey as l, withTimeout$1 as m, clearSharedCodexAppServerClientIfCurrentAndUnclaimed as n, isCodexAppServerStartSelectionChangedError as o, withLeasedCodexAppServerClientStartSelectionRetry as p, CODEX_INTERACTIVE_CUSTOM_THREAD_SOURCES as q, clearSharedCodexAppServerClientIfCurrentAndWait as r, releaseCodexAppServerClientLease as s, clearSharedCodexAppServerClientIfCurrent as t, retainSharedCodexAppServerClientIfCurrent as u, readRecentCodexRateLimits as v, resolveCodexAppServerPreparedApiKeyCacheKey as w, resolveCodexAppServerAuthProfileId as x, rememberCodexRateLimitsRead as y, getCodexAppServerClientInstanceId as z };