@openclaw/codex 2026.7.2-beta.3 → 2026.7.2-beta.5

package/dist/index.js

@@ -1,20 +1,24 @@
 import { registerCodexCliMetadata } from "./cli-metadata.js";
 import { createCodexAppServerAgentHarness } from "./harness.js";
-import { C as resolveCodexAppServerFallbackApiKeyCacheKey, J as CODEX_INTERACTIVE_THREAD_SOURCE_KINDS, S as resolveCodexAppServerAuthProfileIdForAgent, Z as isJsonObject, a as getLeasedSharedCodexAppServerClient, b as resolveCodexAppServerAuthAccountCacheKey, c as releaseLeasedSharedCodexAppServerClient, p as withLeasedCodexAppServerClientStartSelectionRetry, r as clearSharedCodexAppServerClientIfCurrentAndWait, s as releaseCodexAppServerClientLease } from "./shared-client-CSXLtCLE.js";
-import { D as resolveOpenClawExecPolicyForCodexAppServer, E as resolveCodexSupervisionAppServerRuntimeOptions, a as isCodexAppServerNativeAuthProfile, b as resolveCodexAppServerRuntimeOptions, c as sessionBindingIdentity, f as assertCodexAppServerConnectionSecurity, h as codexSandboxPolicyForTurn, m as codexAppServerStartOptionsKey, n as assertCodexBindingMayBeReplaced, o as normalizeCodexAppServerBindingModelProvider, p as canUseCodexModelBackedApprovalsReviewerForModel, u as CODEX_PLUGINS_MARKETPLACE_NAME, y as readCodexPluginConfig } from "./session-binding-Bmt20HfB.js";
-import { d as assertCodexThreadStartResponse } from "./transcript-mirror-D9rTxx2P.js";
-import { i as defaultCodexAppInventoryCache, r as buildCodexPluginAppCacheKey } from "./plugin-app-cache-key-DJbhLYSK.js";
-import { X as ensureCodexPluginActivation, Z as pluginReadParams, c as resumeCodexAppServerThread, h as resolveCodexAppServerRequestModelSelection, p as CODEX_NATIVE_PERSONALITY_NONE } from "./thread-lifecycle-CQ_9mAa1.js";
+import { N as resolveCodexAppServerAuthProfileIdForAgent, P as resolveCodexAppServerFallbackApiKeyCacheKey, R as CODEX_INTERACTIVE_THREAD_SOURCE_KINDS, V as isJsonObject, a as getLeasedSharedCodexAppServerClient, c as releaseCodexAppServerClientLease, j as resolveCodexAppServerAuthAccountCacheKey, l as releaseLeasedSharedCodexAppServerClient, m as withLeasedCodexAppServerClientStartSelectionRetry, r as clearSharedCodexAppServerClientIfCurrentAndWait } from "./shared-client-BVKE40c-.js";
+import { D as resolveOpenClawExecPolicyForCodexAppServer, T as readCodexPluginConfig, _ as assertCodexAppServerConnectionSecurity, b as canUseCodexModelBackedApprovalsReviewerForModel, d as codexAppServerStartOptionsKey, f as codexSandboxPolicyForTurn, g as resolveCodexSupervisionAppServerRuntimeOptions, k as CODEX_PLUGINS_MARKETPLACE_NAME, l as sessionBindingIdentity, n as assertCodexBindingMayBeReplaced, o as isCodexAppServerNativeAuthProfile, p as resolveCodexAppServerRuntimeOptions, s as normalizeCodexAppServerBindingModelProvider } from "./session-binding-DlVQ-Pxs.js";
 import { n as CODEX_APP_SERVER_BINDING_NAMESPACE, t as CODEX_APP_SERVER_BINDING_MAX_ENTRIES } from "./session-binding-meta-B7aEMU7g.js";
-import { t as buildCodexMediaUnderstandingProvider } from "./media-understanding-provider-IPNNQre6.js";
-import { d as CODEX_CONTROL_METHODS, f as describeControlFailure, r as formatCodexDisplayText } from "./command-formatters-NCTL7A2q.js";
-import { t as resolveCodexAppServerForModelProvider } from "./app-server-policy-DUMF2Xyr.js";
+import { n as CODEX_APP_SERVER_UNSUBSCRIBE_TIMEOUT_MS, u as unsubscribeCodexThreadBestEffort } from "./attempt-client-cleanup-Ia52yRWc.js";
+import { J as pluginReadParams, _ as CODEX_NATIVE_PERSONALITY_NONE, c as resumeCodexAppServerThread, q as ensureCodexPluginActivation, y as resolveCodexAppServerRequestModelSelection } from "./thread-lifecycle-DRg_FdzC.js";
+import { i as assertCodexThreadStartResponse } from "./protocol-validators-Dm4eXZmt.js";
+import { i as defaultCodexAppInventoryCache, r as buildCodexPluginAppCacheKey } from "./plugin-app-cache-key-DSXX-rXO.js";
+import { t as isIncognitoSessionKey } from "./incognito-session-ET_ufDH-.js";
+import { buildCodexMediaUnderstandingProvider } from "./media-understanding-provider.js";
+import { n as CODEX_REALTIME_OFFER_PATH, t as configureCodexRealtimeBrowserSession } from "./realtime-voice-api-BPcA1uN9.js";
+import { n as describeControlFailure, t as CODEX_CONTROL_METHODS } from "./capabilities-BHRSI6Cn.js";
+import { r as formatCodexDisplayText } from "./command-formatters-ico4ZFnk.js";
+import { t as resolveCodexAppServerForModelProvider } from "./app-server-policy-BmDgseo_.js";
 import { n as resolveCodexNativeExecutionBlock, r as resolveCodexNativeSandboxBlock } from "./sandbox-guard-D1Wky__S.js";
-import { d as CODEX_NATIVE_EXECUTION_AUTH_ERROR, f as canMutateCodexHost, u as trackCodexConversationActiveTurn } from "./conversation-control-B0s3aIjT.js";
+import { d as CODEX_NATIVE_EXECUTION_AUTH_ERROR, f as canMutateCodexHost, u as trackCodexConversationActiveTurn } from "./conversation-control-DE7d9DOj.js";
 import { a as readCodexConversationBindingDataRecord, i as readCodexConversationBindingData, o as resolveCodexDefaultWorkspaceDir, r as createCodexConversationBindingData } from "./conversation-binding-data-BHRpYbX3.js";
-import { a as resolveCodexBindingAppServerConnection, n as readCodexNotificationThreadId, r as readCodexNotificationTurnId } from "./notification-correlation-C8DVQ_Bq.js";
-import { d as createCodexCliSessionNodeHostCommands, f as createCodexCliSessionNodeInvokePolicies, g as resumeCodexCliSessionOnNode, h as resolveCodexCliSessionForBindingOnNode, i as createCodexSessionCatalogNodeInvokePolicies, m as listCodexCliSessionsOnNode, n as createCodexSessionCatalogControl, o as codexControlRequest, r as createCodexSessionCatalogNodeHostCommands, t as codexSessionCatalogRuntime, u as assertCodexArchiveDescendantsUnowned } from "./session-catalog-CA7R-hX2.js";
-import { r as requestCodexAppServerJson } from "./request-9yf9pZjf.js";
+import { a as resolveCodexBindingAppServerConnection, n as readCodexNotificationThreadId, r as readCodexNotificationTurnId } from "./notification-correlation-Bj_Ak_jI.js";
+import { d as createCodexCliSessionNodeHostCommands, f as createCodexCliSessionNodeInvokePolicies, g as resumeCodexCliSessionOnNode, h as resolveCodexCliSessionForBindingOnNode, i as createCodexSessionCatalogNodeInvokePolicies, m as listCodexCliSessionsOnNode, n as createCodexSessionCatalogControl, o as codexControlRequest, r as createCodexSessionCatalogNodeHostCommands, t as codexSessionCatalogRuntime, u as assertCodexArchiveDescendantsUnowned } from "./session-catalog-CP2oCcEb.js";
+import { r as requestCodexAppServerJson } from "./request-CXpPennK.js";
 import { t as createCodexWebSearchProviderBase } from "./web-search-provider.shared-BrZmlqyR.js";
 import { mutateConfigFile } from "openclaw/plugin-sdk/config-mutation";
 import { normalizePluginsConfig, resolveEffectiveEnableState, resolveLivePluginConfigObject, resolvePluginConfigObject } from "openclaw/plugin-sdk/plugin-config-runtime";
@@ -22,19 +26,19 @@ import { definePluginEntry } from "openclaw/plugin-sdk/plugin-entry";
 import fs from "node:fs/promises";
 import path from "node:path";
 import { parseStrictNonNegativeInteger, resolveTimerTimeoutMs } from "openclaw/plugin-sdk/number-runtime";
+import { formatErrorMessage, resolveSandboxContext } from "openclaw/plugin-sdk/agent-harness-runtime";
+import { loadAuthProfileStoreWithoutExternalProfiles, resolveAgentConfig, resolveAgentWorkspaceDir, resolveDefaultAgentDir, resolveDefaultAgentId, resolveSessionAgentIds as resolveSessionAgentIds$1 } from "openclaw/plugin-sdk/agent-runtime";
 import os from "node:os";
-import { loadAuthProfileStoreWithoutExternalProfiles, resolveAgentConfig, resolveAgentWorkspaceDir, resolveDefaultAgentDir, resolveDefaultAgentId, resolveSessionAgentIds } from "openclaw/plugin-sdk/agent-runtime";
+import { applyAuthProfileConfig, buildApiKeyCredential, buildOauthProviderAuthResult, buildOpenAICodexCredentialExtra, readCodexCliCredentialsCached, resolveOpenAICodexAuthIdentity, resolveOpenAICodexImportProfileName, updateAuthProfileStoreWithLock } from "openclaw/plugin-sdk/provider-auth";
 import { loadExecApprovals } from "openclaw/plugin-sdk/exec-approvals-runtime";
 import { asBoolean, asOptionalRecord, isRecord, normalizeOptionalString, normalizeSingleOrTrimmedStringList, uniqueStrings } from "openclaw/plugin-sdk/string-coerce-runtime";
-import { formatErrorMessage, resolveSandboxContext } from "openclaw/plugin-sdk/agent-harness-runtime";
-import { applyAuthProfileConfig, buildApiKeyCredential, buildOauthProviderAuthResult, buildOpenAICodexCredentialExtra, readCodexCliCredentialsCached, resolveOpenAICodexAuthIdentity, resolveOpenAICodexImportProfileName, updateAuthProfileStoreWithLock } from "openclaw/plugin-sdk/provider-auth";
 import { getSessionEntry, resolveStorePath } from "openclaw/plugin-sdk/session-store-runtime";
 import { fileURLToPath } from "node:url";
 import { expectDefined } from "openclaw/plugin-sdk/expect-runtime";
-import { canonicalPathFromExistingAncestor, isPathInside, pathExists } from "openclaw/plugin-sdk/security-runtime";
+import { canonicalPathFromExistingAncestor, extractErrorCode, isPathInside, pathExists } from "openclaw/plugin-sdk/security-runtime";
 import { KeyedAsyncQueue } from "openclaw/plugin-sdk/keyed-async-queue";
 import { ModelSelectionLockedError, isModelSelectionLocked } from "openclaw/plugin-sdk/model-session-runtime";
-import { MIGRATION_REASON_TARGET_EXISTS, applyMigrationManualItem, createMigrationItem, createMigrationManualItem, hasMigrationConfigPatchConflict, markMigrationItemConflict, markMigrationItemError, markMigrationItemSkipped, readMigrationConfigPath, summarizeMigrationItems, writeMigrationConfigPath } from "openclaw/plugin-sdk/migration";
+import { MIGRATION_REASON_TARGET_EXISTS, applyMigrationManualItem, createMigrationItem, createMigrationManualItem, hasMigrationConfigPatchConflict, markMigrationItemConflict, markMigrationItemError, markMigrationItemSkipped, mergeMigrationConfigValue, readMigrationConfigPath, resolveMigrationConfigRuntime, summarizeMigrationItems, writeMigrationConfigPath } from "openclaw/plugin-sdk/migration";
 import { archiveMigrationItem, copyMemoryMigrationFileItem, copyMigrationFileItem, withCachedMigrationConfigRuntime, writeMigrationReport } from "openclaw/plugin-sdk/migration-runtime";
 import { sleep } from "openclaw/plugin-sdk/runtime-env";
 import { readJsonFileWithFallback } from "openclaw/plugin-sdk/json-store";
@@ -45,13 +49,14 @@ import { createLazyRuntimeModule } from "openclaw/plugin-sdk/lazy-runtime";
 /** Defers schema compilation and auth loading until the first binding operation. */
 function createLazyCodexAppServerBindingStore(state) {
 	let resolved;
-	const store = () => resolved ??= import("./session-binding-Bmt20HfB.js").then((n) => n.l).then(({ createCodexAppServerBindingStore }) => createCodexAppServerBindingStore(state));
+	const store = () => resolved ??= import("./session-binding-DlVQ-Pxs.js").then((n) => n.u).then(({ createCodexAppServerBindingStore }) => createCodexAppServerBindingStore(state));
 	return {
 		read: async (identity) => (await store()).read(identity),
 		hasOtherThreadOwner: async (threadId, currentIdentity) => (await store()).hasOtherThreadOwner(threadId, currentIdentity),
 		mutate: async (identity, mutation) => (await store()).mutate(identity, mutation),
 		prepareSessionGenerationReclaim: async (identity) => (await store()).prepareSessionGenerationReclaim(identity),
 		adoptSessionGeneration: async (identity, previousSessionId) => (await store()).adoptSessionGeneration(identity, previousSessionId),
+		resetSessionGeneration: async (identity) => (await store()).resetSessionGeneration(identity),
 		retireSessionGeneration: async (identity) => (await store()).retireSessionGeneration(identity),
 		withThreadArchiveFence: async (run) => (await store()).withThreadArchiveFence(run),
 		withLease: async (identity, run) => (await store()).withLease(identity, run)
@@ -72,7 +77,7 @@ async function handleCodexCommand(ctx, options) {
 	}
 }
 async function loadDefaultCodexSubcommandHandler() {
-	const { handleCodexSubcommand } = await import("./command-handlers-DtFbZiba.js");
+	const { handleCodexSubcommand } = await import("./command-handlers-CRmnwI2N.js");
 	return handleCodexSubcommand;
 }
 //#endregion
@@ -569,7 +574,8 @@ async function requestNewConversationBindingThread(params, resolved) {
 			personality: CODEX_NATIVE_PERSONALITY_NONE,
 			...buildThreadRequestRuntimeOptions(params, resolved),
 			developerInstructions: CODEX_CONVERSATION_THREAD_DEVELOPER_INSTRUCTIONS,
-			experimentalRawEvents: true
+			experimentalRawEvents: true,
+			...isIncognitoSessionKey(params.sessionKey) ? { ephemeral: true } : {}
 		}, requestOptions),
 		onClientChange: (client) => {
 			resolved.client = client;
@@ -717,7 +723,8 @@ async function runBoundTurn(params) {
 					...modelScopedRuntime.networkProxy ? { config: modelScopedRuntime.networkProxy.configPatch } : { sandbox },
 					...serviceTier ? { serviceTier } : {},
 					developerInstructions: CODEX_CONVERSATION_THREAD_DEVELOPER_INSTRUCTIONS,
-					experimentalRawEvents: true
+					experimentalRawEvents: true,
+					...isIncognitoSessionKey(params.sessionKey) ? { ephemeral: true } : {}
 				}, requestOptions),
 				onClientChange: (nextClient) => {
 					client = nextClient;
@@ -834,6 +841,19 @@ async function runBoundTurn(params) {
 		});
 		collector.setTurnId(turnId);
 		return { reply: { text: (await collector.wait({ timeoutMs: params.timeoutMs ?? DEFAULT_BOUND_TURN_TIMEOUT_MS }).finally(activeCleanup)).replyText.trim() || "Codex completed without a text reply." } };
+	} catch (error) {
+		if (isIncognitoSessionKey(params.sessionKey)) {
+			const bindingReleased = await params.bindingStore.mutate(identity, {
+				kind: "clear",
+				threadId
+			});
+			const timedOut = error instanceof Error && error.message === "codex app-server bound turn timed out";
+			if (bindingReleased && !timedOut) await unsubscribeCodexThreadBestEffort(client, {
+				threadId,
+				timeoutMs: CODEX_APP_SERVER_UNSUBSCRIBE_TIMEOUT_MS
+			});
+		}
+		throw error;
 	} finally {
 		notificationCleanup();
 		requestCleanup();
@@ -920,7 +940,7 @@ async function prepareConversationBinding(params, options = {}) {
 	});
 }
 function resolveConversationExecPolicy(params) {
-	const agentId = params.agentId ?? (params.config ? resolveSessionAgentIds({
+	const agentId = params.agentId ?? (params.config ? resolveSessionAgentIds$1({
 		sessionKey: params.sessionKey,
 		config: params.config
 	}).sessionAgentId : void 0);
@@ -1121,11 +1141,6 @@ async function readModelRefs(source) {
 	refs.add(OPENAI_CODEX_DEFAULT_MODEL);
 	return [...refs].toSorted();
 }
-function readProviderAuthModelConfigs(result) {
-	const models = result.configPatch?.agents?.defaults?.models;
-	if (isRecord(models)) return { ...models };
-	return { [normalizeOptionalString(result.defaultModel) ?? OPENAI_CODEX_DEFAULT_MODEL]: {} };
-}
 async function buildCodexOAuthCredential(source) {
 	const credential = readCodexCliCredentialsCached({
 		codexHome: source.codexHome,
@@ -1160,8 +1175,7 @@ async function buildCodexOAuthCredential(source) {
 		kind: "oauth",
 		provider: OPENAI_PROVIDER_ID,
 		profileId: profile.profileId,
-		result,
-		modelConfigs: readProviderAuthModelConfigs(result)
+		result
 	} : null;
 }
 async function buildCodexApiKeyCredential(source) {
@@ -1219,7 +1233,7 @@ function hasAuthProfileConfigConflict(config, profile, overwrite) {
 function hasCurrentAuthProfileConfigConflict(ctx, profile) {
 	let config = ctx.config;
 	try {
-		config = ctx.runtime?.config?.current?.() ?? config;
+		config = resolveMigrationConfigRuntime(ctx)?.current?.() ?? config;
 	} catch {}
 	return hasAuthProfileConfigConflict(config, profile, Boolean(ctx.overwrite));
 }
@@ -1240,30 +1254,8 @@ function applyDefaultModelIfMissing(cfg) {
 		}
 	};
 }
-function mergeModelConfigEntry(existing, patch) {
-	if (existing && isRecord(existing) && isRecord(patch)) return {
-		...existing,
-		...patch
-	};
-	return existing ?? patch;
-}
-function applyOAuthModelConfigsToConfig(cfg, credential) {
-	const existingModels = cfg.agents?.defaults?.models ?? {};
-	const models = credential.result.replaceDefaultModels ? { ...credential.modelConfigs } : { ...existingModels };
-	if (!credential.result.replaceDefaultModels) for (const [modelRef, modelConfig] of Object.entries(credential.modelConfigs)) models[modelRef] = mergeModelConfigEntry(models[modelRef], modelConfig);
-	return {
-		...cfg,
-		agents: {
-			...cfg.agents,
-			defaults: {
-				...cfg.agents?.defaults,
-				models
-			}
-		}
-	};
-}
 function applyOAuthConfigToConfig(cfg, credential, profileId) {
-	let next = applyOAuthModelConfigsToConfig(cfg, credential);
+	let next = mergeMigrationConfigValue(cfg, credential.result.configPatch);
 	const profile = credential.result.profiles[0];
 	if (profile) next = applyAuthProfileConfig(next, {
 		profileId,
@@ -1287,30 +1279,25 @@ function applyApiKeyConfigToConfig(cfg, credential, profileId) {
 function shouldReturnAuthConfigPatch(ctx) {
 	return ctx.providerOptions?.configPatchMode === CODEX_CONFIG_PATCH_MODE_RETURN$1;
 }
-function oauthAuthProfileConfig(credential, profileId) {
+function authProfileConfigForCredential(credential, profileId) {
+	if (credential.kind === "api_key") return {
+		profileId,
+		provider: credential.provider,
+		mode: "api_key",
+		displayName: CODEX_IMPORT_DISPLAY_NAME
+	};
 	const profile = credential.result.profiles[0];
 	if (!profile || profile.credential.type !== "oauth") return null;
 	return {
 		profileId,
 		provider: profile.credential.provider,
 		mode: "oauth",
-		..."email" in profile.credential && profile.credential.email ? { email: profile.credential.email } : {},
-		..."displayName" in profile.credential && profile.credential.displayName ? { displayName: profile.credential.displayName } : {}
-	};
-}
-function apiKeyAuthProfileConfig(credential, profileId) {
-	return {
-		profileId,
-		provider: credential.provider,
-		mode: "api_key",
-		displayName: CODEX_IMPORT_DISPLAY_NAME
+		...profile.credential.email ? { email: profile.credential.email } : {},
+		...profile.credential.displayName ? { displayName: profile.credential.displayName } : {}
 	};
 }
-function authProfileConfigForCredential(credential, profileId) {
-	return credential.kind === "oauth" ? oauthAuthProfileConfig(credential, profileId) : apiKeyAuthProfileConfig(credential, profileId);
-}
 async function applyCodexAuthProfileConfig(ctx, profile, applyConfig) {
-	const configApi = ctx.runtime?.config;
+	const configApi = resolveMigrationConfigRuntime(ctx);
 	if (!configApi?.current || !configApi.mutateConfigFile) return "unavailable";
 	try {
 		await configApi.mutateConfigFile({
@@ -1327,13 +1314,13 @@ async function applyCodexAuthProfileConfig(ctx, profile, applyConfig) {
 		return error instanceof CodexAuthConfigConflict ? "conflict" : "unavailable";
 	}
 }
-async function applyOAuthConfig(ctx, credential, profileId) {
-	const profile = oauthAuthProfileConfig(credential, profileId);
+async function applyCodexAuthConfig(ctx, credential, profileId) {
+	const profile = authProfileConfigForCredential(credential, profileId);
 	if (!profile) return "unavailable";
-	return applyCodexAuthProfileConfig(ctx, profile, (config) => applyOAuthConfigToConfig(config, credential, profileId));
+	return applyCodexAuthProfileConfig(ctx, profile, (config) => applyCredentialConfig(config, credential, profileId));
 }
-async function applyApiKeyConfig(ctx, credential, profileId) {
-	return applyCodexAuthProfileConfig(ctx, apiKeyAuthProfileConfig(credential, profileId), (config) => applyApiKeyConfigToConfig(config, credential, profileId));
+function applyCredentialConfig(config, credential, profileId) {
+	return credential.kind === "oauth" ? applyOAuthConfigToConfig(config, credential, profileId) : applyApiKeyConfigToConfig(config, credential, profileId);
 }
 async function buildCodexAuthItems(params) {
 	const credentials = await readCodexAuthCredentials(params.source);
@@ -1366,26 +1353,27 @@ async function buildCodexAuthItems(params) {
 		});
 	});
 }
-async function applyCodexAuthItem(params) {
+async function applyCodexAuthItems(params) {
 	const { ctx, item, source, targets } = params;
-	if (item.status !== "planned") return item;
+	if (item.status !== "planned") return [item];
 	const profileId = typeof item.details?.profileId === "string" ? item.details.profileId : "";
 	const provider = typeof item.details?.provider === "string" ? item.details.provider : "";
 	const sourceProfileId = typeof item.details?.sourceProfileId === "string" ? item.details.sourceProfileId : void 0;
-	if (!profileId || !provider) return markMigrationItemError(item, CODEX_REASON_MISSING_AUTH_METADATA);
+	if (!profileId || !provider) return [markMigrationItemError(item, CODEX_REASON_MISSING_AUTH_METADATA)];
 	const credential = (await readCodexAuthCredentials(source)).find((candidate) => candidate.provider === provider);
-	if (!credential) return markMigrationItemSkipped(item, CODEX_REASON_AUTH_NO_LONGER_PRESENT);
-	if (credential.kind === "oauth" && sourceProfileId && credential.profileId !== sourceProfileId) return markMigrationItemSkipped(item, CODEX_REASON_AUTH_NO_LONGER_PRESENT);
+	if (!credential) return [markMigrationItemSkipped(item, CODEX_REASON_AUTH_NO_LONGER_PRESENT)];
+	if (credential.kind === "oauth" && sourceProfileId && credential.profileId !== sourceProfileId) return [markMigrationItemSkipped(item, CODEX_REASON_AUTH_NO_LONGER_PRESENT)];
 	const oauthProfile = credential.kind === "oauth" ? credential.result.profiles[0] : void 0;
 	const oauthCredential = oauthProfile?.credential.type === "oauth" ? oauthProfile.credential : void 0;
-	if (credential.kind === "oauth" && !oauthCredential) return markMigrationItemError(item, CODEX_REASON_MISSING_AUTH_METADATA);
+	if (credential.kind === "oauth" && !oauthCredential) return [markMigrationItemError(item, CODEX_REASON_MISSING_AUTH_METADATA)];
 	const configProfile = authProfileConfigForCredential(credential, profileId);
-	if (!configProfile) return markMigrationItemError(item, CODEX_REASON_MISSING_AUTH_METADATA);
-	if (hasCurrentAuthProfileConfigConflict(ctx, configProfile)) return markMigrationItemConflict(item, CODEX_REASON_AUTH_PROFILE_EXISTS);
+	if (!configProfile) return [markMigrationItemError(item, CODEX_REASON_MISSING_AUTH_METADATA)];
+	if (hasCurrentAuthProfileConfigConflict(ctx, configProfile)) return [markMigrationItemConflict(item, CODEX_REASON_AUTH_PROFILE_EXISTS)];
 	let conflicted = false;
 	let wrote = false;
 	const store = await updateAuthProfileStoreWithLock({
 		agentDir: targets.agentDir,
+		stateDir: ctx.stateDir,
 		updater: (freshStore) => {
 			const existing = freshStore.profiles[profileId];
 			if (!ctx.overwrite && existing) {
@@ -1404,11 +1392,11 @@ async function applyCodexAuthItem(params) {
 			return true;
 		}
 	});
-	if (conflicted) return markMigrationItemConflict(item, CODEX_REASON_AUTH_PROFILE_EXISTS);
-	if (!store?.profiles[profileId]) return markMigrationItemError(item, CODEX_REASON_AUTH_PROFILE_WRITE_FAILED);
-	const configResult = shouldReturnAuthConfigPatch(ctx) ? "unavailable" : credential.kind === "oauth" ? await applyOAuthConfig(ctx, credential, profileId) : await applyApiKeyConfig(ctx, credential, profileId);
-	if (configResult === "conflict") return markMigrationItemConflict(item, CODEX_REASON_AUTH_PROFILE_EXISTS);
-	return {
+	if (conflicted) return [markMigrationItemConflict(item, CODEX_REASON_AUTH_PROFILE_EXISTS)];
+	if (!store?.profiles[profileId]) return [markMigrationItemError(item, CODEX_REASON_AUTH_PROFILE_WRITE_FAILED)];
+	const configResult = shouldReturnAuthConfigPatch(ctx) ? "unavailable" : await applyCodexAuthConfig(ctx, credential, profileId);
+	if (configResult === "conflict") return [markMigrationItemConflict(item, CODEX_REASON_AUTH_PROFILE_EXISTS)];
+	const migratedItem = {
 		...item,
 		status: "migrated",
 		details: {
@@ -1418,18 +1406,10 @@ async function applyCodexAuthItem(params) {
 			...shouldReturnAuthConfigPatch(ctx) ? { configPatchReturned: true } : {}
 		}
 	};
+	return [migratedItem, ...shouldReturnAuthConfigPatch(ctx) ? buildCodexAuthConfigPatchItems(ctx, migratedItem, credential, profileId) : []];
 }
-async function buildCodexAuthConfigPatchItems(params) {
-	const { ctx, item, source } = params;
-	if (item.status !== "migrated" || !shouldReturnAuthConfigPatch(ctx)) return [];
-	const profileId = typeof item.details?.profileId === "string" ? item.details.profileId : "";
-	const provider = typeof item.details?.provider === "string" ? item.details.provider : "";
-	const sourceProfileId = typeof item.details?.sourceProfileId === "string" ? item.details.sourceProfileId : void 0;
-	if (!profileId || !provider) return [];
-	const credential = (await readCodexAuthCredentials(source)).find((candidate) => candidate.provider === provider);
-	if (!credential) return [];
-	if (credential.kind === "oauth" && sourceProfileId && credential.profileId !== sourceProfileId) return [];
-	const next = credential.kind === "oauth" ? applyOAuthConfigToConfig(ctx.config, credential, profileId) : applyApiKeyConfigToConfig(ctx.config, credential, profileId);
+function buildCodexAuthConfigPatchItems(ctx, item, credential, profileId) {
+	const next = applyCredentialConfig(ctx.config, credential, profileId);
 	const items = [];
 	if (next.auth) items.push(createMigrationItem({
 		id: `${item.id}:config:auth`,
@@ -1458,108 +1438,6 @@ async function buildCodexAuthConfigPatchItems(params) {
 	return items;
 }
 //#endregion
-//#region extensions/codex/src/migration/memory-plan.ts
-const MIGRATION_REASON_TARGET_NOT_REGULAR = "target is not a regular file";
-async function lstatIfExists(filePath) {
-	try {
-		return await fs.lstat(filePath);
-	} catch (error) {
-		const code = error && typeof error === "object" && "code" in error ? String(error.code) : void 0;
-		if (code === "ENOENT" || code === "ENOTDIR") return;
-		throw error;
-	}
-}
-async function assertSafeMemoryDestination(params) {
-	const [canonicalSource, canonicalWorkspace, canonicalTarget] = await Promise.all([
-		fs.realpath(path.dirname(params.source)),
-		canonicalPathFromExistingAncestor(params.workspaceDir),
-		canonicalPathFromExistingAncestor(params.target)
-	]);
-	if (!isPathInside(canonicalWorkspace, canonicalTarget)) throw new Error("Codex memory import destination must stay in the selected workspace.");
-	if (isPathInside(canonicalSource, canonicalTarget) || isPathInside(canonicalTarget, canonicalSource)) throw new Error("Codex memory source and OpenClaw import destination must be separate paths.");
-}
-async function buildCodexMemoryItems(params) {
-	const items = [];
-	for (const memory of params.memoryFiles) {
-		const target = path.join(params.workspaceDir, "memory", "imports", "codex", path.basename(memory.path));
-		const targetStat = await lstatIfExists(target);
-		const targetExists = targetStat !== void 0;
-		const targetNotRegular = targetExists && !targetStat.isFile();
-		if (!targetNotRegular) await assertSafeMemoryDestination({
-			source: memory.path,
-			workspaceDir: params.workspaceDir,
-			target
-		});
-		const targetConflict = targetNotRegular || targetExists && !params.overwrite;
-		items.push(createMigrationItem({
-			id: memory.id,
-			kind: "memory",
-			action: "copy",
-			source: memory.path,
-			target,
-			status: targetConflict ? "conflict" : "planned",
-			reason: targetNotRegular ? MIGRATION_REASON_TARGET_NOT_REGULAR : targetConflict ? MIGRATION_REASON_TARGET_EXISTS : void 0,
-			message: "Copy consolidated Codex memory into the OpenClaw memory index.",
-			details: {
-				sourceType: "codex-memory",
-				sourceLabel: memory.label,
-				collectionId: "codex",
-				collectionLabel: "Codex",
-				relativePath: path.basename(memory.path)
-			}
-		}));
-	}
-	return items;
-}
-//#endregion
-//#region extensions/codex/src/migration/skill-plan.ts
-function uniqueSkillName(skill, counts) {
-	const base = sanitizeName(skill.name) || "codex-skill";
-	if ((counts.get(base) ?? 0) <= 1) return base;
-	return sanitizeName([
-		"codex",
-		sanitizeName(path.basename(path.dirname(skill.source))),
-		base
-	].filter(Boolean).join("-")) || base;
-}
-async function buildCodexSkillItems(params) {
-	const baseCounts = /* @__PURE__ */ new Map();
-	for (const skill of params.skills) {
-		const base = sanitizeName(skill.name) || "codex-skill";
-		baseCounts.set(base, (baseCounts.get(base) ?? 0) + 1);
-	}
-	const resolvedCounts = /* @__PURE__ */ new Map();
-	const planned = params.skills.map((skill) => {
-		const name = uniqueSkillName(skill, baseCounts);
-		resolvedCounts.set(name, (resolvedCounts.get(name) ?? 0) + 1);
-		return {
-			skill,
-			name,
-			target: path.join(params.workspaceDir, "skills", name)
-		};
-	});
-	const items = [];
-	for (const item of planned) {
-		const collides = (resolvedCounts.get(item.name) ?? 0) > 1;
-		const targetExists = await exists(item.target);
-		items.push(createMigrationItem({
-			id: `skill:${item.name}`,
-			kind: "skill",
-			action: "copy",
-			source: item.skill.source,
-			target: item.target,
-			status: collides ? "conflict" : targetExists && !params.overwrite ? "conflict" : "planned",
-			reason: collides ? `multiple Codex skills normalize to "${item.name}"` : targetExists && !params.overwrite ? MIGRATION_REASON_TARGET_EXISTS : void 0,
-			message: `Copy ${item.skill.sourceLabel} into this OpenClaw agent workspace.`,
-			details: {
-				skillName: item.name,
-				sourceLabel: item.skill.sourceLabel
-			}
-		}));
-	}
-	return items;
-}
-//#endregion
 //#region extensions/codex/src/migration/source-files.ts
 const SKILL_FILENAME = "SKILL.md";
 const MAX_SCAN_DEPTH = 6;
@@ -1600,8 +1478,6 @@ async function discoverPluginDirs(codexHome) {
 			discovered.set(dir, {
 				name: manifestName || path.basename(dir),
 				source: dir,
-				manifestPath,
-				sourceKind: "cache",
 				migratable: false,
 				message: "Cached Codex plugin bundle found. Review manually unless the plugin is also installed in the source Codex app-server inventory"
 			});
@@ -1625,7 +1501,7 @@ async function discoverCodexMemoryFile(candidate) {
 }
 async function discoverCodexMemorySources(codexHome) {
 	const memoriesDir = path.join(codexHome, "memories");
-	const memoryFiles = (await Promise.all([{
+	return (await Promise.all([{
 		id: "memory:codex:MEMORY.md",
 		label: "Codex consolidated memory",
 		name: "MEMORY.md"
@@ -1638,10 +1514,6 @@ async function discoverCodexMemorySources(codexHome) {
 		label: candidate.label,
 		path: path.join(memoriesDir, candidate.name)
 	})))).filter((entry) => entry !== void 0);
-	return {
-		...await isDirectory(memoriesDir) ? { memoriesDir } : {},
-		memoryFiles
-	};
 }
 //#endregion
 //#region extensions/codex/src/migration/source.ts
@@ -1713,7 +1585,6 @@ function buildInstalledPluginSource(plugin) {
 		pluginName,
 		marketplaceName: CODEX_PLUGINS_MARKETPLACE_NAME,
 		source: `${CODEX_PLUGINS_MARKETPLACE_NAME}/${pluginName}`,
-		sourceKind: "app-server",
 		migratable: true,
 		installed: plugin.installed,
 		enabled: plugin.enabled
@@ -1920,8 +1791,7 @@ function pluginNameFromSummary(summary) {
 		if (normalized) return normalized;
 	}
 }
-async function discoverCodexSource(inputOrOptions) {
-	const options = typeof inputOrOptions === "string" || inputOrOptions === void 0 ? { input: inputOrOptions } : inputOrOptions;
+async function discoverCodexSource(options = {}) {
 	const codexHome = resolveHomePath(options.input?.trim() || defaultCodexHome());
 	const codexSkillsDir = path.join(codexHome, "skills");
 	const agentsSkillsDir = personalAgentsSkillsDir();
@@ -1929,7 +1799,7 @@ async function discoverCodexSource(inputOrOptions) {
 	const authPath = path.join(codexHome, "auth.json");
 	const modelsCachePath = path.join(codexHome, "models_cache.json");
 	const hooksPath = path.join(codexHome, "hooks", "hooks.json");
-	const { memoriesDir, memoryFiles } = await discoverCodexMemorySources(codexHome);
+	const memoryFiles = await discoverCodexMemorySources(codexHome);
 	const codexSkills = options.memoryOnly ? [] : await discoverSkillDirs({
 		root: codexSkillsDir,
 		sourceLabel: "Codex skill",
@@ -1969,11 +1839,8 @@ async function discoverCodexSource(inputOrOptions) {
 		codexHome,
 		...await isDirectory(codexSkillsDir) ? { codexSkillsDir } : {},
 		...await isDirectory(agentsSkillsDir) ? { personalAgentsSkillsDir: agentsSkillsDir } : {},
-		...await exists(configPath) ? { configPath } : {},
 		...hasAuth ? { authPath } : {},
 		...await exists(modelsCachePath) ? { modelsCachePath } : {},
-		...await exists(hooksPath) ? { hooksPath } : {},
-		...memoriesDir ? { memoriesDir } : {},
 		memoryFiles,
 		skills,
 		plugins,
@@ -2022,12 +1889,98 @@ const CODEX_PLUGIN_NATIVE_CONFIG_PATH = [
 ];
 const MIGRATION_REASON_PLUGIN_EXISTS = "plugin exists";
 const CODEX_PLUGIN_SOURCE_APP_VERIFICATION_UNVERIFIED = "not_run";
-function uniquePluginConfigKey(plugin, counts, usedCounts) {
-	const base = sanitizeName(plugin.pluginName ?? plugin.name) || "codex-plugin";
+const MIGRATION_REASON_TARGET_NOT_REGULAR = "target is not a regular file";
+async function lstatIfExists(filePath) {
+	try {
+		return await fs.lstat(filePath);
+	} catch (error) {
+		const code = extractErrorCode(error);
+		if (code === "ENOENT" || code === "ENOTDIR") return;
+		throw error;
+	}
+}
+async function buildCodexMemoryItems(params) {
+	const items = [];
+	for (const memory of params.memoryFiles) {
+		const target = path.join(params.workspaceDir, "memory", "imports", "codex", path.basename(memory.path));
+		const targetStat = await lstatIfExists(target);
+		const targetNotRegular = targetStat !== void 0 && !targetStat.isFile();
+		if (!targetNotRegular) {
+			const [source, workspace, destination] = await Promise.all([
+				fs.realpath(path.dirname(memory.path)),
+				canonicalPathFromExistingAncestor(params.workspaceDir),
+				canonicalPathFromExistingAncestor(target)
+			]);
+			if (!isPathInside(workspace, destination)) throw new Error("Codex memory import destination must stay in the selected workspace.");
+			if (isPathInside(source, destination) || isPathInside(destination, source)) throw new Error("Codex memory source and OpenClaw import destination must be separate paths.");
+		}
+		const targetConflict = targetStat !== void 0 && !params.overwrite;
+		items.push(createMigrationItem({
+			id: memory.id,
+			kind: "memory",
+			action: "copy",
+			source: memory.path,
+			target,
+			status: targetNotRegular || targetConflict ? "conflict" : "planned",
+			reason: targetNotRegular ? MIGRATION_REASON_TARGET_NOT_REGULAR : targetConflict ? MIGRATION_REASON_TARGET_EXISTS : void 0,
+			message: "Copy consolidated Codex memory into the OpenClaw memory index.",
+			details: {
+				sourceType: "codex-memory",
+				sourceLabel: memory.label,
+				collectionId: "codex",
+				collectionLabel: "Codex",
+				relativePath: path.basename(memory.path)
+			}
+		}));
+	}
+	return items;
+}
+function uniqueSkillName(skill, counts) {
+	const base = sanitizeName(skill.name) || "codex-skill";
 	if ((counts.get(base) ?? 0) <= 1) return base;
-	const next = (usedCounts.get(base) ?? 0) + 1;
-	usedCounts.set(base, next);
-	return sanitizeName(`${base}-${next}`) || base;
+	return sanitizeName([
+		"codex",
+		sanitizeName(path.basename(path.dirname(skill.source))),
+		base
+	].filter(Boolean).join("-")) || base;
+}
+async function buildCodexSkillItems(params) {
+	const counts = /* @__PURE__ */ new Map();
+	for (const skill of params.skills) {
+		const base = sanitizeName(skill.name) || "codex-skill";
+		counts.set(base, (counts.get(base) ?? 0) + 1);
+	}
+	const planned = params.skills.map((skill) => {
+		const name = uniqueSkillName(skill, counts);
+		return {
+			skill,
+			name,
+			target: path.join(params.workspaceDir, "skills", name)
+		};
+	});
+	const resolvedCounts = planned.reduce((resolved, item) => {
+		resolved.set(item.name, (resolved.get(item.name) ?? 0) + 1);
+		return resolved;
+	}, /* @__PURE__ */ new Map());
+	return await Promise.all(planned.map(async (item) => {
+		const collision = (resolvedCounts.get(item.name) ?? 0) > 1;
+		const targetExists = await exists(item.target);
+		const conflict = collision || targetExists && !params.overwrite;
+		return createMigrationItem({
+			id: `skill:${item.name}`,
+			kind: "skill",
+			action: "copy",
+			source: item.skill.source,
+			target: item.target,
+			status: conflict ? "conflict" : "planned",
+			reason: collision ? `multiple Codex skills normalize to "${item.name}"` : conflict ? MIGRATION_REASON_TARGET_EXISTS : void 0,
+			message: `Copy ${item.skill.sourceLabel} into this OpenClaw agent workspace.`,
+			details: {
+				skillName: item.name,
+				sourceLabel: item.skill.sourceLabel
+			}
+		});
+	}));
 }
 function readExistingCodexPluginEntries(config) {
 	const entries = readMigrationConfigPath(config, [...CODEX_PLUGIN_NATIVE_CONFIG_PATH, "plugins"]);
@@ -2058,18 +2011,12 @@ function readExistingPluginAllowDestructiveActions(existing, pluginName) {
 	return normalized === "auto" || normalized === "ask" ? normalized : void 0;
 }
 function buildPluginItems(ctx, plugins) {
-	const baseCounts = /* @__PURE__ */ new Map();
-	for (const plugin of plugins.filter((entry) => entry.migratable)) {
-		const base = sanitizeName(plugin.pluginName ?? plugin.name) || "codex-plugin";
-		baseCounts.set(base, (baseCounts.get(base) ?? 0) + 1);
-	}
 	const existingPluginEntries = readExistingCodexPluginEntries(ctx.config);
-	const usedCounts = /* @__PURE__ */ new Map();
 	let manualIndex = 0;
 	const items = [];
 	for (const plugin of plugins) {
 		if (plugin.migratable && plugin.marketplaceName === "openai-curated" && plugin.pluginName) {
-			const configKey = uniquePluginConfigKey(plugin, baseCounts, usedCounts);
+			const configKey = plugin.pluginName;
 			const plannedEntry = {
 				enabled: true,
 				marketplaceName: CODEX_PLUGINS_MARKETPLACE_NAME,
@@ -2086,6 +2033,7 @@ function buildPluginItems(ctx, plugins) {
 				action: "install",
 				status: conflict ? "conflict" : "planned",
 				reason: conflict ? MIGRATION_REASON_PLUGIN_EXISTS : void 0,
+				applyPhase: "after-promotion",
 				source: plugin.source,
 				target: `plugins.entries.codex.config.codexPlugins.plugins.${configKey}`,
 				message: `Install Codex plugin "${plugin.pluginName}" in the OpenClaw-managed Codex app-server runtime.`,
@@ -2103,12 +2051,6 @@ function buildPluginItems(ctx, plugins) {
 		}
 		manualIndex += 1;
 		if (plugin.migrationBlock && plugin.pluginName) {
-			const details = {
-				pluginName: plugin.pluginName,
-				marketplaceName: CODEX_PLUGINS_MARKETPLACE_NAME,
-				...plugin.migrationBlock.apps ? { apps: plugin.migrationBlock.apps } : {},
-				...plugin.migrationBlock.error ? { error: plugin.migrationBlock.error } : {}
-			};
 			items.push(createMigrationItem({
 				id: `plugin:${sanitizeName(plugin.name) || sanitizeName(path.basename(plugin.source))}:${manualIndex}`,
 				kind: "manual",
@@ -2117,7 +2059,12 @@ function buildPluginItems(ctx, plugins) {
 				status: "skipped",
 				reason: plugin.migrationBlock.code,
 				message: plugin.message ?? `Codex native plugin "${plugin.name}" was found but not activated automatically.`,
-				details: { ...details }
+				details: {
+					pluginName: plugin.pluginName,
+					marketplaceName: CODEX_PLUGINS_MARKETPLACE_NAME,
+					...plugin.migrationBlock.apps ? { apps: plugin.migrationBlock.apps } : {},
+					...plugin.migrationBlock.error ? { error: plugin.migrationBlock.error } : {}
+				}
 			}));
 			continue;
 		}
@@ -2155,7 +2102,6 @@ function normalizeExistingAllowDestructiveActions(value) {
 	return asBoolean(value);
 }
 function readExistingPluginPolicyRepairs(config) {
-	if (config === void 0) return {};
 	return Object.fromEntries(Object.entries(readExistingCodexPluginEntries(config)).flatMap(([configKey, entry]) => {
 		const pluginEntry = isRecord(entry) ? entry : void 0;
 		if (pluginEntry?.allow_destructive_actions !== "on-request") return [];
@@ -2165,9 +2111,9 @@ function readExistingPluginPolicyRepairs(config) {
 		}]];
 	}));
 }
-function buildCodexPluginsConfigValue(entries, params = {}) {
+function buildCodexPluginsConfigValue(entries, config) {
 	const plugins = {
-		...readExistingPluginPolicyRepairs(params.config),
+		...readExistingPluginPolicyRepairs(config),
 		...Object.fromEntries(entries.toSorted((a, b) => a.configKey.localeCompare(b.configKey)).map((entry) => [entry.configKey, {
 			enabled: entry.enabled,
 			marketplaceName: CODEX_PLUGINS_MARKETPLACE_NAME,
@@ -2179,7 +2125,7 @@ function buildCodexPluginsConfigValue(entries, params = {}) {
 		enabled: true,
 		config: { codexPlugins: {
 			enabled: true,
-			allow_destructive_actions: params.config === void 0 ? true : readExistingAllowDestructiveActions(params.config) ?? true,
+			allow_destructive_actions: readExistingAllowDestructiveActions(config) ?? true,
 			plugins
 		} }
 	};
@@ -2206,7 +2152,7 @@ function hasCodexPluginConfigConflict(config, value) {
 function buildPluginConfigItem(ctx, pluginItems) {
 	const entries = pluginItems.filter((item) => item.status === "planned").map((item) => readCodexPluginMigrationConfigEntry(item, true)).filter((entry) => entry !== void 0);
 	if (entries.length === 0) return;
-	const value = buildCodexPluginsConfigValue(entries, { config: ctx.config });
+	const value = buildCodexPluginsConfigValue(entries, ctx.config);
 	const conflict = !ctx.overwrite && hasCodexPluginConfigConflict(ctx.config, value);
 	return createMigrationItem({
 		id: CODEX_PLUGIN_CONFIG_ITEM_ID,
@@ -2215,6 +2161,7 @@ function buildPluginConfigItem(ctx, pluginItems) {
 		target: "plugins.entries.codex.config.codexPlugins",
 		status: conflict ? "conflict" : "planned",
 		reason: conflict ? MIGRATION_REASON_TARGET_EXISTS : void 0,
+		applyPhase: "after-promotion",
 		message: "Enable OpenClaw's Codex plugin integration and record migrated source-installed curated plugins.",
 		details: {
 			path: [...CODEX_PLUGIN_CONFIG_PATH],
@@ -2331,15 +2278,9 @@ async function applyCodexMigrationPlan(params) {
 	const targets = resolveCodexMigrationTargets(params.ctx);
 	const codexHome = typeof plan.metadata?.codexHome === "string" && plan.metadata.codexHome.trim() ? plan.metadata.codexHome : plan.source;
 	const authSource = {
-		root: plan.source,
-		confidence: "high",
 		codexHome,
 		authPath: path.join(codexHome, "auth.json"),
-		modelsCachePath: path.join(codexHome, "models_cache.json"),
-		memoryFiles: [],
-		skills: [],
-		plugins: [],
-		archivePaths: []
+		modelsCachePath: path.join(codexHome, "models_cache.json")
 	};
 	const runtime = withCachedMigrationConfigRuntime(params.ctx.runtime ?? params.runtime, params.ctx.config);
 	const applyCtx = {
@@ -2352,20 +2293,13 @@ async function applyCodexMigrationPlan(params) {
 			continue;
 		}
 		if (item.id === "config:codex-plugins") items.push(await applyCodexPluginConfigItem(applyCtx, item, items));
-		else if (item.kind === "auth") {
-			const authItem = await applyCodexAuthItem({
-				ctx: applyCtx,
-				item,
-				source: authSource,
-				targets
-			});
-			items.push(authItem);
-			items.push(...await buildCodexAuthConfigPatchItems({
-				ctx: applyCtx,
-				item: authItem,
-				source: authSource
-			}));
-		} else if (item.kind === "plugin" && item.action === "install") items.push(await applyCodexPluginInstallItem(applyCtx, item));
+		else if (item.kind === "auth") items.push(...await applyCodexAuthItems({
+			ctx: applyCtx,
+			item,
+			source: authSource,
+			targets
+		}));
+		else if (item.kind === "plugin" && item.action === "install") items.push(await applyCodexPluginInstallItem(applyCtx, item));
 		else if (item.kind === "manual") items.push(applyMigrationManualItem(item));
 		else if (item.action === "archive") items.push(await archiveMigrationItem(item, reportDir));
 		else if (item.kind === "memory") items.push(await copyMemoryMigrationFileItem(item, reportDir, {
@@ -2542,13 +2476,21 @@ async function buildTargetCodexPluginAppCacheKey(ctx) {
 	});
 }
 async function applyCodexPluginConfigItem(ctx, item, appliedItems) {
+	if (appliedItems.filter((candidate) => candidate.kind === "plugin" && candidate.action === "install" && readCodexPluginPolicy(candidate) !== void 0 && !isCodexPluginConfigTerminal(candidate)).length > 0) return {
+		...item,
+		status: "warning",
+		reason: "selected Codex plugin activation is incomplete"
+	};
 	const entries = appliedItems.map(readAppliedPluginConfigEntry).filter((entry) => entry !== void 0);
-	if (entries.length === 0) return markMigrationItemSkipped(item, "no selected Codex plugins");
+	if (entries.length === 0) return {
+		...markMigrationItemSkipped(item, "no selected Codex plugins"),
+		deferredCompletion: true
+	};
 	const returnPatch = shouldReturnCodexPluginConfigPatch(ctx);
-	const configApi = ctx.runtime?.config;
+	const configApi = resolveMigrationConfigRuntime(ctx);
 	const currentConfig = returnPatch ? ctx.config : configApi?.current?.();
 	if (!currentConfig) return markMigrationItemError(item, "config runtime unavailable");
-	const value = buildCodexPluginsConfigValue(entries, { config: currentConfig });
+	const value = buildCodexPluginsConfigValue(entries, currentConfig);
 	if (!ctx.overwrite && hasCodexPluginConfigConflict(currentConfig, value)) return markMigrationItemConflict(item, MIGRATION_REASON_TARGET_EXISTS);
 	const migratedItem = {
 		...item,
@@ -2576,19 +2518,20 @@ async function applyCodexPluginConfigItem(ctx, item, appliedItems) {
 		return markMigrationItemError(item, error instanceof Error ? error.message : String(error));
 	}
 }
+function isCodexPluginConfigTerminal(item) {
+	return item.status === "migrated" || item.status === "skipped" && (item.deferredCompletion === true || item.reason === CODEX_PLUGIN_NOT_SELECTED_REASON || item.reason === CODEX_PLUGIN_AUTH_REQUIRED_REASON);
+}
 function readAppliedPluginConfigEntry(item) {
-	if (item.status === "migrated") return readCodexPluginMigrationConfigEntry(item, true);
-	if (item.status === "skipped" && item.reason !== CODEX_PLUGIN_NOT_SELECTED_REASON && item.reason === CODEX_PLUGIN_AUTH_REQUIRED_REASON) return readCodexPluginMigrationConfigEntry(item, false);
+	if (item.status === "migrated" || item.deferredCompletion === true) return readCodexPluginMigrationConfigEntry(item, true);
+	if (item.status === "skipped" && item.reason === CODEX_PLUGIN_AUTH_REQUIRED_REASON) return readCodexPluginMigrationConfigEntry(item, false);
 }
 function readCodexPluginPolicy(item) {
-	const configKey = item.details?.configKey;
-	const marketplaceName = item.details?.marketplaceName;
-	const pluginName = item.details?.pluginName;
-	if (typeof configKey !== "string" || marketplaceName !== "openai-curated" || typeof pluginName !== "string") return;
+	const entry = readCodexPluginMigrationConfigEntry(item, true);
+	if (!entry) return;
 	return {
-		configKey,
+		configKey: entry.configKey,
 		marketplaceName: CODEX_PLUGINS_MARKETPLACE_NAME,
-		pluginName,
+		pluginName: entry.pluginName,
 		enabled: true,
 		allowDestructiveActions: true,
 		destructiveApprovalMode: "allow"
@@ -2620,6 +2563,7 @@ function buildCodexMigrationProvider(params = {}) {
 			};
 		},
 		plan: buildCodexMigrationPlan,
+		deferredApply: { retrySafe: true },
 		prepareApply(ctx) {
 			if (isMemoryOnlyMigration(ctx)) return;
 			return prepareTargetCodexAppServer(ctx);
@@ -2801,7 +2745,7 @@ function createCodexThreadsTool(options) {
 	return {
 		name: "codex_threads",
 		label: "Codex Threads",
-		description: "List and inspect native Codex threads. When supervision is enabled, raw transcript reads and every mutation require their matching supervision policy option.",
+		description: "Manage native Codex threads: list, read, fork, rename, archive (confirm:true), unarchive. When supervision is enabled, raw transcript reads and every mutation require their matching supervision policy option.",
 		parameters: CodexThreadsParamsSchema,
 		async execute(_toolCallId, rawParams) {
 			const params = asRecord$1(rawParams);
@@ -3726,7 +3670,7 @@ function createCodexSupervisionTools(options) {
 }
 //#endregion
 //#region extensions/codex/src/web-search-provider.ts
-const loadCodexWebSearchRuntime = createLazyRuntimeModule(() => import("./web-search-provider.runtime-_x5XTeqh.js"));
+const loadCodexWebSearchRuntime = createLazyRuntimeModule(() => import("./web-search-provider.runtime-CaQMYDbp.js"));
 const CodexWebSearchSchema = {
 	type: "object",
 	properties: { query: {
@@ -3780,11 +3724,39 @@ var codex_default = definePluginEntry({
 				origin: "bundled",
 				config: normalizePluginsConfig(liveConfig.plugins),
 				rootConfig: liveConfig,
-				enabledByDefault: readCodexPluginConfig(livePluginConfig).supervision?.enabled === true
+				enabledByDefault: livePluginConfig !== void 0
 			}).enabled) return;
 			return livePluginConfig;
 		};
 		const resolveCurrentPluginConfig = () => resolvePluginConfig(resolveCurrentConfig);
+		if (api.registrationMode === "full") {
+			const realtimeBrowserSession = configureCodexRealtimeBrowserSession({
+				getConfig: resolveCurrentConfig,
+				getPluginConfig: resolveCurrentPluginConfig
+			});
+			api.registerHttpRoute({
+				path: CODEX_REALTIME_OFFER_PATH,
+				auth: "plugin",
+				match: "exact",
+				handler: realtimeBrowserSession.handler
+			});
+			api.registerService({
+				id: "codex-oauth-realtime-browser-session-warmup",
+				start: () => {
+					realtimeBrowserSession.warmup().catch((error) => {
+						api.logger.debug?.(`Codex OAuth realtime warmup unavailable: ${error instanceof Error ? error.message : String(error)}`);
+					});
+				}
+			});
+			api.lifecycle.registerRuntimeLifecycle({
+				id: "codex-oauth-realtime-browser-session",
+				description: "Release Codex OAuth realtime browser sessions when the plugin stops",
+				cleanup: async ({ reason }) => {
+					if (reason === "reset" || reason === "delete") return;
+					await realtimeBrowserSession.cleanup();
+				}
+			});
+		}
 		let bindingStateStore;
 		const openBindingStateStore = () => bindingStateStore ??= api.runtime.state.openSyncKeyedStore({
 			namespace: CODEX_APP_SERVER_BINDING_NAMESPACE,
@@ -3825,8 +3797,10 @@ var codex_default = definePluginEntry({
 		}, { names: [...CODEX_SUPERVISION_COMPAT_TOOL_NAMES] });
 		api.registerAgentHarness(createCodexAppServerAgentHarness({
 			bindingStore,
+			sessionCatalogControl,
 			resolveConfig: resolveCurrentConfig,
-			resolvePluginConfig: resolveCurrentPluginConfig
+			resolvePluginConfig: resolveCurrentPluginConfig,
+			runtime: api.runtime
 		}));
 		api.registerMediaUnderstandingProvider(buildCodexMediaUnderstandingProvider({ pluginConfig: api.pluginConfig }));
 		api.registerWebSearchProvider(createCodexWebSearchProvider({ resolvePluginConfig: resolveCurrentPluginConfig }));
@@ -3914,7 +3888,7 @@ var codex_default = definePluginEntry({
 			if (!previousSessionId || !sessionId || previousSessionId === sessionId) return;
 			const config = resolveCurrentConfig();
 			const sessionKey = ctx.sessionKey?.trim();
-			const { sessionBindingIdentity } = await import("./session-binding-Bmt20HfB.js").then((n) => n.l);
+			const { sessionBindingIdentity } = await import("./session-binding-DlVQ-Pxs.js").then((n) => n.u);
 			const identity = sessionBindingIdentity({
 				sessionId,
 				...sessionKey ? { sessionKey } : {},
@@ -3930,8 +3904,9 @@ var codex_default = definePluginEntry({
 			const endedSessionKey = sessionKey?.trim();
 			const nextSessionKey = event.nextSessionKey?.trim();
 			if (endedSessionKey && nextSessionKey && nextSessionKey !== endedSessionKey) return;
+			if (event.nextSessionId?.trim() === event.sessionId.trim()) return;
 			const config = resolveCurrentConfig();
-			const { sessionBindingIdentity } = await import("./session-binding-Bmt20HfB.js").then((n) => n.l);
+			const { sessionBindingIdentity } = await import("./session-binding-DlVQ-Pxs.js").then((n) => n.u);
 			await bindingStore.retireSessionGeneration(sessionBindingIdentity({
 				sessionId: event.sessionId,
 				...sessionKey ? { sessionKey } : {},