@openclaw/codex 2026.7.2-beta.4 → 2026.7.2-beta.5

package/dist/{shared-client-wmgNFNYp.js → shared-client-BVKE40c-.js}

@@ -1,1865 +1,2016 @@
 import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
-import { C as resolveCodexAppServerUserHomeDir, S as resolveCodexAppServerStartOptionsForAgent, h as codexAppServerStartOptionsKey, o as isCodexAppServerNativeAuthProfile, w as resolveCodexComputerUseConfig, x as resolveCodexAppServerRuntimeOptions } from "./session-binding-ZSMX1omP.js";
+import { d as codexAppServerStartOptionsKey, h as resolveCodexComputerUseConfig, m as resolveCodexAppServerStartOptionsForAgent, o as isCodexAppServerNativeAuthProfile, p as resolveCodexAppServerRuntimeOptions, x as resolveCodexAppServerUserHomeDir } from "./session-binding-DlVQ-Pxs.js";
 import { n as resolveCodexAppServerSpawnEnv, t as createStdioTransport } from "./transport-stdio-DXgGZ7Ib.js";
 import { createRequire } from "node:module";
 import fs, { access } from "node:fs/promises";
 import path from "node:path";
 import { addTimerTimeoutGraceMs, resolveTimerTimeoutMs } from "openclaw/plugin-sdk/number-runtime";
-import { sliceUtf16Safe, truncateUtf16Safe } from "openclaw/plugin-sdk/text-utility-runtime";
+import { AgentHarnessPreflightError, OPENCLAW_VERSION, embeddedAgentLog } from "openclaw/plugin-sdk/agent-harness-runtime";
 import { createHash, randomUUID } from "node:crypto";
+import { ensureAuthProfileStore, findPersistedAuthProfileCredential, loadAuthProfileStoreForSecretsRuntime, refreshOAuthCredentialForRuntime, resolveApiKeyForProfile, resolveAuthProfileOrder, resolveDefaultAgentDir, resolvePersistedAuthProfileOwnerAgentDir, resolveProviderIdForAuth } from "openclaw/plugin-sdk/agent-runtime";
+import { createDeferred } from "openclaw/plugin-sdk/extension-shared";
 import fsSync, { constants, existsSync, readFileSync, realpathSync } from "node:fs";
 import os from "node:os";
-import { ensureAuthProfileStore, findPersistedAuthProfileCredential, loadAuthProfileStoreForSecretsRuntime, refreshOAuthCredentialForRuntime, resolveApiKeyForProfile, resolveAuthProfileOrder, resolveDefaultAgentDir, resolvePersistedAuthProfileOwnerAgentDir, resolveProviderIdForAuth } from "openclaw/plugin-sdk/agent-runtime";
-import { OPENCLAW_VERSION, embeddedAgentLog } from "openclaw/plugin-sdk/agent-harness-runtime";
+import { isDeepStrictEqual } from "node:util";
+import { hasUsableOAuthCredential } from "openclaw/plugin-sdk/provider-auth";
+import { runExec } from "openclaw/plugin-sdk/process-runtime";
 import { createInterface } from "node:readline";
+import { sliceUtf16Safe, truncateUtf16Safe } from "openclaw/plugin-sdk/text-utility-runtime";
 import { parse } from "semver";
 import { EventEmitter } from "node:events";
 import net from "node:net";
 import { PassThrough, Writable } from "node:stream";
 import { StringDecoder } from "node:string_decoder";
 import WebSocket from "ws";
-import { createDeferred } from "openclaw/plugin-sdk/extension-shared";
-import { isDeepStrictEqual } from "node:util";
-import { hasUsableOAuthCredential } from "openclaw/plugin-sdk/provider-auth";
 import { fileURLToPath } from "node:url";
 import { expectDefined } from "openclaw/plugin-sdk/expect-runtime";
 import { withTimeout } from "openclaw/plugin-sdk/security-runtime";
-//#region extensions/codex/src/app-server/protocol.ts
-/** Namespace Codex keeps directly model-visible without exposing it to Code Mode guests. */
-const CODEX_OPENCLAW_DIRECT_DYNAMIC_TOOL_NAMESPACE = "openclaw_direct";
-function flattenCodexDynamicToolFunctions(tools) {
-	return (tools ?? []).flatMap((tool) => tool.type === "namespace" ? tool.tools : [tool]);
-}
-const CODEX_INTERACTIVE_THREAD_SOURCE_KINDS = ["cli", "vscode"];
-const CODEX_INTERACTIVE_CUSTOM_THREAD_SOURCES = ["atlas", "chatgpt"];
-function isJsonObject$1(value) {
-	return Boolean(value && typeof value === "object" && !Array.isArray(value));
-}
-function isRpcResponse(message) {
-	return "id" in message && !("method" in message);
-}
-//#endregion
-//#region extensions/codex/src/app-server/transport-websocket.ts
+//#region extensions/codex/src/app-server/attempt-timeouts.ts
 /**
-* Adapts a remote Codex app-server WebSocket endpoint to the shared stdio-like
-* transport interface.
+* Timeout defaults and normalizers for Codex app-server startup and turn
+* liveness watches.
 */
-/** Opens a WebSocket app-server transport and maps newline-delimited frames to stdout/stdin. */
-function createWebSocketTransport(options) {
-	if (!options.url) throw new Error("codex app-server websocket transport requires plugins.entries.codex.config.appServer.url");
-	const events = new EventEmitter();
-	const stdout = new PassThrough();
-	const stderr = new PassThrough();
-	const websocketOptions = {
-		headers: {
-			...options.headers,
-			...options.authToken ? { Authorization: `Bearer ${options.authToken}` } : {}
-		},
-		perMessageDeflate: false
-	};
-	const unixSocketPath = resolveCodexAppServerUnixSocketPath(options);
-	const socket = unixSocketPath ? new WebSocket("ws://localhost/", {
-		...websocketOptions,
-		createConnection: () => connectCodexAppServerUnixSocket(unixSocketPath)
-	}) : new WebSocket(options.url, websocketOptions);
-	const pendingFrames = [];
-	const stdinDecoder = new StringDecoder("utf8");
-	let pendingLine = "";
-	let killed = false;
-	const sendFrame = (frame) => {
-		const trimmed = frame.trim();
-		if (!trimmed) return;
-		if (socket.readyState === WebSocket.OPEN) {
-			socket.send(trimmed);
-			return;
-		}
-		pendingFrames.push(trimmed);
-	};
-	socket.once("open", () => {
-		for (const frame of pendingFrames.splice(0)) socket.send(frame);
-	});
-	socket.once("error", (error) => events.emit("error", error));
-	socket.once("close", (code, reason) => {
-		killed = true;
-		events.emit("exit", code, reason.toString("utf8"));
-	});
-	socket.on("message", (data) => {
-		const text = websocketFrameToText(data);
-		stdout.write(text.endsWith("\n") ? text : `${text}\n`);
-	});
-	const stdin = new Writable({
-		write(chunk, _encoding, callback) {
-			pendingLine += stdinDecoder.write(chunk);
-			const lines = pendingLine.split("\n");
-			pendingLine = lines.pop() ?? "";
-			for (const frame of lines) sendFrame(frame);
-			callback();
-		},
-		final(callback) {
-			pendingLine += stdinDecoder.end();
-			if (pendingLine) sendFrame(pendingLine);
-			pendingLine = "";
-			callback();
-		}
-	});
-	const closeSocket = () => {
-		if (socket.readyState === WebSocket.CLOSED || socket.readyState === WebSocket.CLOSING) return;
-		socket.close();
-	};
-	stdin.once("finish", closeSocket);
-	stdin.once("close", closeSocket);
-	return {
-		stdin,
-		stdout,
-		stderr,
-		get killed() {
-			return killed;
-		},
-		kill: () => {
-			killed = true;
-			socket.close();
-		},
-		once: (event, listener) => events.once(event, listener)
-	};
+/** Minimum startup timeout accepted by the Codex app-server harness. */
+const CODEX_APP_SERVER_STARTUP_TIMEOUT_FLOOR_MS = 100;
+/** Default idle timeout while waiting for app-server turn completion. */
+const CODEX_TURN_COMPLETION_IDLE_TIMEOUT_MS = 6e4;
+/** Short guard after apparent assistant completion. */
+const CODEX_TURN_ASSISTANT_COMPLETION_IDLE_TIMEOUT_MS = 1e4;
+const CODEX_POST_TOOL_RAW_ASSISTANT_COMPLETION_IDLE_TIMEOUT_MS = 5 * 6e4;
+/** Guard after reasoning/commentary progress when no tool handoff occurred. */
+const CODEX_POST_REASONING_REPLY_IDLE_TIMEOUT_MS = 5 * 6e4;
+/** Long terminal idle watch for app-server turns that never send completion. */
+const CODEX_TURN_TERMINAL_IDLE_TIMEOUT_MS = 30 * 6e4;
+var CodexAppServerStartupError = class extends Error {
+	constructor(reason, message = reason === "timed_out" ? "codex app-server startup timed out" : "codex app-server startup aborted") {
+		super(message);
+		this.reason = reason;
+		this.code = "CODEX_APP_SERVER_STARTUP_CANCELLED";
+		this.name = "CodexAppServerStartupError";
+	}
+};
+function isCodexAppServerStartupError(error, reason) {
+	return error instanceof Error && "code" in error && error.code === "CODEX_APP_SERVER_STARTUP_CANCELLED" && "reason" in error && (error.reason === "aborted" || error.reason === "timed_out") && (reason === void 0 || error.reason === reason);
 }
-/** Opens the owner-scoped Codex control socket used by the WebSocket upgrade. */
-function connectCodexAppServerUnixSocket(socketPath) {
-	return net.createConnection(socketPath);
+function resolvePositiveIntegerTimeoutMs(value, fallbackMs) {
+	return resolveTimerTimeoutMs(value, resolveTimerTimeoutMs(fallbackMs, 1));
 }
-/** Resolves the canonical or explicitly configured Codex control socket. */
-function resolveCodexAppServerUnixSocketPath(options) {
-	if (options.transport !== "unix") {
-		if (options.url?.startsWith("unix://")) throw new Error("codex app-server unix URL requires unix transport");
-		return;
+/** Runs startup work with abort and timeout handling plus optional cleanup. */
+async function withCodexStartupTimeout(params) {
+	if (params.signal.aborted) throw new CodexAppServerStartupError("aborted");
+	let timeout;
+	let abortCleanup;
+	let timeoutError;
+	let timeoutCleanup;
+	try {
+		return await Promise.race([params.operation(), new Promise((_, reject) => {
+			const rejectOnce = (error) => {
+				if (timeout) {
+					clearTimeout(timeout);
+					timeout = void 0;
+				}
+				reject(error);
+			};
+			timeout = setTimeout(() => {
+				timeoutError = new CodexAppServerStartupError("timed_out");
+				timeoutCleanup = Promise.resolve(params.onTimeout?.()).then(() => void 0, () => void 0);
+				timeoutCleanup.finally(() => {
+					rejectOnce(timeoutError);
+				});
+			}, params.timeoutMs);
+			const abortListener = () => rejectOnce(new CodexAppServerStartupError("aborted"));
+			params.signal.addEventListener("abort", abortListener, { once: true });
+			abortCleanup = () => params.signal.removeEventListener("abort", abortListener);
+		})]);
+	} catch (error) {
+		if (timeoutError) {
+			await timeoutCleanup;
+			throw timeoutError;
+		}
+		throw error;
+	} finally {
+		if (timeout) clearTimeout(timeout);
+		abortCleanup?.();
 	}
-	const url = options.url ?? "unix://";
-	if (!url.startsWith("unix://")) throw new Error("codex app-server unix transport requires a unix:// URL");
-	return url.slice(7) || path.join(resolveCodexAppServerUserHomeDir(options.env ?? process.env), "app-server-control", "app-server-control.sock");
 }
-function websocketFrameToText(data) {
-	if (typeof data === "string") return data;
-	if (Buffer.isBuffer(data)) return data.toString("utf8");
-	if (Array.isArray(data)) return Buffer.concat(data).toString("utf8");
-	return Buffer.from(data).toString("utf8");
+/** Resolves startup timeout while honoring the configured floor. */
+function resolveCodexStartupTimeoutMs(params) {
+	const timeoutFloorMs = resolvePositiveIntegerTimeoutMs(params.timeoutFloorMs, CODEX_APP_SERVER_STARTUP_TIMEOUT_FLOOR_MS);
+	const timeoutMs = resolvePositiveIntegerTimeoutMs(params.timeoutMs, timeoutFloorMs);
+	return Math.max(timeoutFloorMs, timeoutMs);
 }
-//#endregion
-//#region extensions/codex/src/app-server/transport.ts
-/** Starts graceful transport shutdown and schedules a force kill fallback. */
-function closeCodexAppServerTransport(child, options = {}) {
-	child.stdin.end?.();
-	child.stdin.destroy?.();
-	const forceKillDelayMs = options.forceKillDelayMs ?? 1e3;
-	const forceKill = setTimeout(() => {
-		if (hasCodexAppServerTransportExited(child)) return;
-		signalCodexAppServerTransport(child, "SIGKILL");
-	}, Math.max(1, forceKillDelayMs));
-	forceKill.unref?.();
-	child.once("exit", () => {
-		clearTimeout(forceKill);
-		child.stdout.destroy?.();
-		child.stderr.destroy?.();
-	});
-	child.unref?.();
-	child.stdout.unref?.();
-	child.stderr.unref?.();
-	child.stdin.unref?.();
+/** Resolves the completion-idle timeout for an active turn. */
+function resolveCodexTurnCompletionIdleTimeoutMs(value) {
+	return resolvePositiveIntegerTimeoutMs(value, CODEX_TURN_COMPLETION_IDLE_TIMEOUT_MS);
 }
-/** Closes a transport and waits briefly for an exit event. */
-async function closeCodexAppServerTransportAndWait(child, options = {}) {
-	if (!hasCodexAppServerTransportExited(child)) closeCodexAppServerTransport(child, options);
-	return await waitForCodexAppServerTransportExit(child, options.exitTimeoutMs ?? 2e3);
+/** Resolves the short assistant-completion release timeout. */
+function resolveCodexTurnAssistantCompletionIdleTimeoutMs(value) {
+	return resolvePositiveIntegerTimeoutMs(value, CODEX_TURN_ASSISTANT_COMPLETION_IDLE_TIMEOUT_MS);
 }
-function hasCodexAppServerTransportExited(child) {
-	return child.exitCode !== null && child.exitCode !== void 0 ? true : child.signalCode !== null && child.signalCode !== void 0;
+/** Resolves the conservative post-tool raw assistant guard timeout. */
+function resolveCodexPostToolRawAssistantCompletionIdleTimeoutMs(value, fallbackMs) {
+	return resolvePositiveIntegerTimeoutMs(value, Math.max(resolvePositiveIntegerTimeoutMs(void 0, fallbackMs), CODEX_POST_TOOL_RAW_ASSISTANT_COMPLETION_IDLE_TIMEOUT_MS));
 }
-async function waitForCodexAppServerTransportExit(child, timeoutMs) {
-	if (hasCodexAppServerTransportExited(child)) return true;
-	return await new Promise((resolve) => {
-		let settled = false;
-		const onExit = () => {
-			if (settled) return;
-			settled = true;
-			clearTimeout(timeout);
-			resolve(true);
-		};
-		const timeout = setTimeout(() => {
-			if (settled) return;
-			settled = true;
-			child.off?.("exit", onExit);
-			resolve(false);
-		}, Math.max(1, timeoutMs));
-		child.once("exit", onExit);
-	});
+/** Resolves the long terminal turn idle timeout. */
+function resolveCodexTurnTerminalIdleTimeoutMs(value, runTimeoutOverrideMs) {
+	const explicitRunBudgetMs = resolvePositiveIntegerTimeoutMs(runTimeoutOverrideMs, CODEX_TURN_TERMINAL_IDLE_TIMEOUT_MS);
+	return resolvePositiveIntegerTimeoutMs(value, Math.max(CODEX_TURN_TERMINAL_IDLE_TIMEOUT_MS, explicitRunBudgetMs));
 }
-function signalCodexAppServerTransport(child, signal) {
-	if (child.pid && process.platform !== "win32") try {
-		process.kill(-child.pid, signal);
-		return;
-	} catch {}
-	child.kill?.(signal);
+/** Adds gateway grace time to a caller timeout without overflowing invalid values. */
+function resolveCodexGatewayTimeoutWithGraceMs(timeoutMs, graceMs = 1e4) {
+	const timeout = resolvePositiveIntegerTimeoutMs(timeoutMs, 1);
+	return addTimerTimeoutGraceMs(timeout, resolveTimerTimeoutMs(graceMs, 0, 0)) ?? timeout;
 }
 //#endregion
-//#region extensions/codex/src/app-server/version.ts
-/**
-* Version and package pins for the managed Codex app-server runtime.
-*/
-/** Minimum Codex app-server version supported by the OpenClaw Codex bridge. */
-const MIN_CODEX_APP_SERVER_VERSION = "0.143.0";
-/** Newest Codex app-server version validated by the OpenClaw Codex bridge. */
-const MAX_CODEX_APP_SERVER_VERSION = "0.145.0";
-/** npm package name for the managed Codex app-server binary. */
-const MANAGED_CODEX_APP_SERVER_PACKAGE = "@openai/codex";
+//#region extensions/codex/src/app-server/auth-start-options.ts
+const CODEX_APP_SERVER_HOME_DIRNAME = "codex-home";
+const CODEX_EPHEMERAL_AUTH_STORE_OVERRIDE = "cli_auth_credentials_store=\"ephemeral\"";
+function resolveCodexAppServerHomeDir(agentDir) {
+	return path.join(path.resolve(agentDir), CODEX_APP_SERVER_HOME_DIRNAME);
+}
+/** Forces OpenClaw-owned Codex auth to remain process-local. */
+function withEphemeralCodexAuthStore(params) {
+	const { startOptions } = params;
+	if (!(startOptions.commandSource === "managed" || startOptions.commandSource === "resolved-managed") || !params.preparedAuth && params.authProfileId === null) return startOptions;
+	if (startOptions.args.at(-2) === "-c" && startOptions.args.at(-1) === CODEX_EPHEMERAL_AUTH_STORE_OVERRIDE) return startOptions;
+	return {
+		...startOptions,
+		args: [
+			...startOptions.args,
+			"-c",
+			CODEX_EPHEMERAL_AUTH_STORE_OVERRIDE
+		]
+	};
+}
 //#endregion
-//#region extensions/codex/src/app-server/client.ts
-/**
-* JSON-RPC client for Codex app-server transports, including request/response
-* routing, notification fanout, server request handlers, and version checks.
-*/
-/** Minimum supported Codex app-server version exported for callers/tests. */
-const CODEX_APP_SERVER_PARSE_LOG_MAX = 500;
-const CODEX_APP_SERVER_PARSE_BUFFER_MAX = 8 * 1024 * 1024;
-const CODEX_APP_SERVER_PARSE_BUFFER_MAX_LINES = 1e3;
-const CODEX_DYNAMIC_TOOL_SERVER_REQUEST_TIMEOUT_MS = 66e4;
-const CODEX_APP_SERVER_STDERR_TAIL_MAX = 2e3;
-const CODEX_APP_SERVER_OVERLOADED_ERROR_CODE = -32001;
-const CODEX_APP_SERVER_OVERLOAD_MAX_RETRIES = 3;
-const CODEX_APP_SERVER_OVERLOAD_RETRY_BASE_MS = 50;
-const CODEX_APP_SERVER_CLIENT_INSTANCE_IDS = /* @__PURE__ */ new WeakMap();
-const UNPAIRED_SURROGATE_RE = /[\uD800-\uDBFF](?![\uDC00-\uDFFF])|(?<![\uD800-\uDBFF])[\uDC00-\uDFFF]/g;
-/** Process-local generation fence for bindings tied to one app-server client instance. */
-function getCodexAppServerClientInstanceId(client) {
-	const current = CODEX_APP_SERVER_CLIENT_INSTANCE_IDS.get(client);
-	if (current) return current;
-	const created = randomUUID();
-	CODEX_APP_SERVER_CLIENT_INSTANCE_IDS.set(client, created);
-	return created;
+//#region extensions/codex/src/app-server/desktop-app-paths.ts
+/** Shared path candidates for Codex's macOS desktop app bundle. */
+const MACOS_DESKTOP_CODEX_APP_PATH_CANDIDATES = [{
+	appName: "ChatGPT.app",
+	appBundlePath: "/Applications/ChatGPT.app",
+	appServerCommandPath: "/Applications/ChatGPT.app/Contents/Resources/codex",
+	bundledMarketplacePath: "/Applications/ChatGPT.app/Contents/Resources/plugins/openai-bundled",
+	computerUseServiceAppPaths: ["/Applications/ChatGPT.app/Contents/Resources/cua_node/lib/node_modules/@oai/sky/Codex Computer Use.app", "/Applications/ChatGPT.app/Contents/Resources/plugins/openai-bundled/plugins/computer-use/Codex Computer Use.app"]
+}, {
+	appName: "Codex.app",
+	appBundlePath: "/Applications/Codex.app",
+	appServerCommandPath: "/Applications/Codex.app/Contents/Resources/codex",
+	bundledMarketplacePath: "/Applications/Codex.app/Contents/Resources/plugins/openai-bundled",
+	computerUseServiceAppPaths: ["/Applications/Codex.app/Contents/Resources/plugins/openai-bundled/plugins/computer-use/Codex Computer Use.app", "/Applications/Codex.app/Contents/Resources/cua_node/lib/node_modules/@oai/sky/Codex Computer Use.app"]
+}];
+function resolveMacOSDesktopCodexBundledMarketplaceCandidates(platform = process.platform) {
+	return platform === "darwin" ? MACOS_DESKTOP_CODEX_APP_PATH_CANDIDATES.map((candidate) => candidate.bundledMarketplacePath) : [];
 }
-function resolveCodexAppServerClientInstanceId(client) {
-	return client.getInstanceId?.call(client) ?? getCodexAppServerClientInstanceId(client);
+function resolveMacOSDesktopCodexComputerUseServiceAppCandidates(platform = process.platform, appServerCommand) {
+	if (platform !== "darwin") return [];
+	const matchingCandidate = appServerCommand ? MACOS_DESKTOP_CODEX_APP_PATH_CANDIDATES.find((candidate) => path.resolve(candidate.appServerCommandPath) === path.resolve(appServerCommand)) : void 0;
+	const orderedCandidates = matchingCandidate ? [matchingCandidate, ...MACOS_DESKTOP_CODEX_APP_PATH_CANDIDATES.filter((candidate) => candidate !== matchingCandidate)] : MACOS_DESKTOP_CODEX_APP_PATH_CANDIDATES;
+	return [...new Set(orderedCandidates.flatMap((candidate) => candidate.computerUseServiceAppPaths))];
 }
-/** RPC error wrapper that preserves app-server error code and data. */
-var CodexAppServerRpcError = class extends Error {
-	constructor(error, method) {
-		super(formatCodexAppServerRpcErrorMessage(error, method));
-		this.name = "CodexAppServerRpcError";
-		this.code = error.code;
-		this.data = error.data;
-		this.method = method;
+function resolveFirstExistingMacOSDesktopCodexBundledMarketplacePath(params = {}) {
+	const candidates = params.candidates ?? resolveMacOSDesktopCodexBundledMarketplaceCandidates(params.platform);
+	const pathExists = params.pathExists ?? existsSync;
+	return candidates.find((candidate) => pathExists(candidate));
+}
+//#endregion
+//#region extensions/codex/src/app-server/computer-use-cache.ts
+/** Shared Computer Use plugin cache reconciliation for isolated Codex homes. */
+const DEFAULT_CODEX_COMPUTER_USE_BUNDLED_MARKETPLACE_PATH = resolveMacOSDesktopCodexBundledMarketplaceCandidates("darwin")[0] ?? "";
+const DEFAULT_BUNDLED_MARKETPLACE_NAME = "openai-bundled";
+async function ensureCodexComputerUseSharedPluginCache(params) {
+	if (!params.config.enabled) return skippedCacheResult("disabled", "Computer Use cache sharing skipped because it is disabled.");
+	if (params.config.pluginCacheMode === "independent") return skippedCacheResult("independent", "Computer Use cache sharing skipped because pluginCacheMode is independent.");
+	if (params.config.marketplaceName || params.config.marketplacePath) return skippedCacheResult("explicit_marketplace", "Computer Use cache sharing skipped because an explicit marketplace is configured.");
+	const bundledMarketplacePath = resolveComputerUseBundledMarketplacePath(params);
+	const sourcePluginRoot = path.join(bundledMarketplacePath, "plugins", params.config.pluginName);
+	const version = await readBundledPluginVersion(sourcePluginRoot);
+	if (!version) return skippedCacheResult("source_missing", `Computer Use bundled plugin source was not found at ${sourcePluginRoot}.`);
+	const marketplaceName = params.config.marketplaceName ?? DEFAULT_BUNDLED_MARKETPLACE_NAME;
+	const cacheRoot = path.join(params.codexHome, "plugins", "cache", marketplaceName, params.config.pluginName);
+	const cachePath = path.join(cacheRoot, version);
+	return {
+		status: "shared",
+		changed: await ensureRealDirectoryCopy(cachePath, sourcePluginRoot, version),
+		cachePath,
+		targetPath: sourcePluginRoot,
+		version,
+		removedStaleVersions: [],
+		warnings: [],
+		message: `Computer Use plugin cache ${cachePath} contains bundled plugin ${sourcePluginRoot}.`
+	};
+}
+function resolveComputerUseBundledMarketplacePath(params) {
+	return params.bundledMarketplacePath ?? resolveFirstExistingMacOSDesktopCodexBundledMarketplacePath({ candidates: params.bundledMarketplacePathCandidates }) ?? params.bundledMarketplacePathCandidates?.[0] ?? DEFAULT_CODEX_COMPUTER_USE_BUNDLED_MARKETPLACE_PATH;
+}
+async function readBundledPluginVersion(sourcePluginRoot) {
+	const pluginJsonPath = path.join(sourcePluginRoot, ".codex-plugin", "plugin.json");
+	let raw;
+	try {
+		raw = await fs.readFile(pluginJsonPath, "utf8");
+	} catch {
+		return;
 	}
-};
-var CodexAppServerLocalRequestCancellationError = class extends Error {
-	constructor(method, reason, mayHaveWritten) {
-		super(`${method} ${reason}`);
-		this.reason = reason;
-		this.mayHaveWritten = mayHaveWritten;
-		this.code = "CODEX_APP_SERVER_LOCAL_REQUEST_CANCELLED";
-		this.name = "CodexAppServerLocalRequestCancellationError";
+	try {
+		const parsed = JSON.parse(raw);
+		return typeof parsed.version === "string" && parsed.version.trim() ? parsed.version.trim() : void 0;
+	} catch {
+		return;
 	}
-};
-function isCodexAppServerRequestTimeoutError(error) {
-	return error instanceof Error && "code" in error && error.code === "CODEX_APP_SERVER_LOCAL_REQUEST_CANCELLED" && "reason" in error && error.reason === "timed out";
 }
-function isCodexAppServerBrokenPipeError(error) {
-	const seen = /* @__PURE__ */ new Set();
-	let current = error;
-	while (current && typeof current === "object" && !seen.has(current)) {
-		seen.add(current);
-		if ("code" in current && current.code === "EPIPE") return true;
-		current = "cause" in current ? current.cause : void 0;
+async function ensureRealDirectoryCopy(cachePath, sourcePluginRoot, version) {
+	await fs.mkdir(path.dirname(cachePath), { recursive: true });
+	const stat = await fs.lstat(cachePath).catch(() => void 0);
+	if (stat?.isDirectory() && !stat.isSymbolicLink()) {
+		if (await readBundledPluginVersion(cachePath) === version) return false;
 	}
-	return false;
-}
-var CodexAppServerIndeterminateTransportError = class extends Error {
-	constructor(method, cause) {
-		super(`${method} transport failed after request write: ${cause.message}`, { cause });
-		this.code = "CODEX_APP_SERVER_REQUEST_TRANSPORT_INDETERMINATE";
-		this.mayHaveWritten = true;
-		this.name = "CodexAppServerIndeterminateTransportError";
+	const cacheRoot = path.dirname(cachePath);
+	const cacheName = path.basename(cachePath);
+	const stagingRoot = await fs.mkdtemp(path.join(cacheRoot, `.${cacheName}.staging-`));
+	const stagedPath = path.join(stagingRoot, cacheName);
+	const backupPath = path.join(cacheRoot, `.${cacheName}.backup-${process.pid}-${Date.now()}`);
+	let backupCreated = false;
+	try {
+		await fs.cp(sourcePluginRoot, stagedPath, { recursive: true });
+		if (stat) {
+			await fs.rename(cachePath, backupPath);
+			backupCreated = true;
+		}
+		try {
+			await fs.rename(stagedPath, cachePath);
+		} catch (error) {
+			if (backupCreated) try {
+				await fs.rename(backupPath, cachePath);
+				backupCreated = false;
+			} catch (restoreError) {
+				throw new Error(`Failed to install Computer Use cache ${cachePath} and restore its prior copy: ${String(error)}`, { cause: restoreError });
+			}
+			throw error;
+		}
+		if (backupCreated) await fs.rm(backupPath, {
+			recursive: true,
+			force: true
+		});
+		return true;
+	} finally {
+		await fs.rm(stagingRoot, {
+			recursive: true,
+			force: true
+		});
 	}
-};
-/** True when a local cancellation can leave an app-server request in flight. */
-function isCodexAppServerIndeterminateRequestCancellationError(error) {
-	return error instanceof Error && "code" in error && error.code === "CODEX_APP_SERVER_LOCAL_REQUEST_CANCELLED" && "mayHaveWritten" in error && error.mayHaveWritten === true;
 }
-/** True when local cancellation happened before a request write was attempted. */
-function isCodexAppServerPrewriteRequestCancellationError(error) {
-	return error instanceof Error && "code" in error && error.code === "CODEX_APP_SERVER_LOCAL_REQUEST_CANCELLED" && "mayHaveWritten" in error && error.mayHaveWritten === false;
+function skippedCacheResult(status, message) {
+	return {
+		status,
+		changed: false,
+		message,
+		removedStaleVersions: [],
+		warnings: status === "source_missing" ? [message] : []
+	};
 }
-/** True when transport failure cannot prove a written request stopped running. */
-function isCodexAppServerIndeterminateTransportError(error) {
-	return error instanceof Error && "code" in error && error.code === "CODEX_APP_SERVER_REQUEST_TRANSPORT_INDETERMINATE" && "mayHaveWritten" in error && error.mayHaveWritten === true;
+//#endregion
+//#region extensions/codex/src/app-server/computer-use-service.ts
+/** Native Computer Use service provisioning for isolated Codex homes. */
+const SERVICE_APP_NAME = "Codex Computer Use.app";
+const CLIENT_RELATIVE_PATH = path.join("Contents", "SharedSupport", "SkyComputerUseClient.app", "Contents", "MacOS", "SkyComputerUseClient");
+const COPY_TIMEOUT_MS = 12e4;
+const activeInstalls = /* @__PURE__ */ new Map();
+/** Ensures the official native client exists beneath the CODEX_HOME used by its launcher. */
+async function ensureCodexComputerUseServiceApp(params) {
+	const platform = params.platform ?? process.platform;
+	if (platform !== "darwin") return {
+		status: "unsupported",
+		changed: false
+	};
+	const targetPath = path.join(path.resolve(params.codexHome), "computer-use", SERVICE_APP_NAME);
+	const active = activeInstalls.get(targetPath);
+	if (active) return await active;
+	const install = ensureCodexComputerUseServiceAppOnce({
+		...params,
+		targetPath,
+		platform
+	});
+	activeInstalls.set(targetPath, install);
+	try {
+		return await install;
+	} finally {
+		if (activeInstalls.get(targetPath) === install) activeInstalls.delete(targetPath);
+	}
 }
-function formatCodexAppServerRpcErrorMessage(error, method) {
-	const message = error.message || `${method} failed`;
-	const detail = readCodexAppServerRpcReloginDetail(error.data);
-	return detail && !message.includes(detail) ? `${message}: ${detail}` : message;
+async function ensureCodexComputerUseServiceAppOnce(params) {
+	if (await hasExecutableClient(params.targetPath)) return {
+		status: "already_installed",
+		changed: false,
+		targetPath: params.targetPath
+	};
+	const sourcePath = await findUsableServiceApp(params.sourceAppCandidates ?? resolveMacOSDesktopCodexComputerUseServiceAppCandidates(params.platform, params.appServerCommand));
+	if (!sourcePath) return {
+		status: "source_missing",
+		changed: false,
+		targetPath: params.targetPath
+	};
+	const targetParent = path.dirname(params.targetPath);
+	await fs.mkdir(targetParent, { recursive: true });
+	const stagingRoot = await fs.mkdtemp(path.join(targetParent, ".service-app.staging-"));
+	const stagedPath = path.join(stagingRoot, SERVICE_APP_NAME);
+	const backupPath = path.join(targetParent, `.service-app.backup-${process.pid}-${Date.now()}`);
+	let backupCreated = false;
+	try {
+		await (params.copyServiceApp ?? copyServiceAppWithDitto)(sourcePath, stagedPath);
+		if (!await hasExecutableClient(stagedPath)) throw new Error(`Copied Computer Use service app is incomplete at ${stagedPath}.`);
+		if (await pathExists$1(params.targetPath)) {
+			await fs.rename(params.targetPath, backupPath);
+			backupCreated = true;
+			if (await hasExecutableClient(backupPath)) {
+				await fs.rename(backupPath, params.targetPath);
+				backupCreated = false;
+				return {
+					status: "already_installed",
+					changed: false,
+					targetPath: params.targetPath,
+					sourcePath
+				};
+			}
+		}
+		try {
+			await fs.rename(stagedPath, params.targetPath);
+		} catch (error) {
+			if (!await hasExecutableClient(params.targetPath)) {
+				if (backupCreated) {
+					await fs.rename(backupPath, params.targetPath);
+					backupCreated = false;
+				}
+				throw error;
+			}
+			if (backupCreated) {
+				await fs.rm(backupPath, {
+					recursive: true,
+					force: true
+				});
+				backupCreated = false;
+			}
+			return {
+				status: "already_installed",
+				changed: false,
+				targetPath: params.targetPath,
+				sourcePath
+			};
+		}
+		if (backupCreated) {
+			await fs.rm(backupPath, {
+				recursive: true,
+				force: true
+			});
+			backupCreated = false;
+		}
+		return {
+			status: "installed",
+			changed: true,
+			targetPath: params.targetPath,
+			sourcePath
+		};
+	} finally {
+		await fs.rm(stagingRoot, {
+			recursive: true,
+			force: true
+		});
+	}
 }
-function readCodexAppServerRpcReloginDetail(data) {
-	const record = isJsonObject(data) ? data : void 0;
-	const nested = isJsonObject(record?.error) ? record.error : record;
-	if (!nested) return;
-	const isRelogin = nested.action === "relogin" || nested.reason === "cloudRequirements" && nested.errorCode === "Auth";
-	const detail = typeof nested.detail === "string" ? nested.detail.trim() : "";
-	return isRelogin && detail ? detail : void 0;
+async function pathExists$1(filePath) {
+	return await fs.lstat(filePath).then(() => true, () => false);
 }
-function isJsonObject(value) {
+async function findUsableServiceApp(candidates) {
+	for (const candidate of candidates) if (await hasExecutableClient(candidate)) return candidate;
+}
+async function hasExecutableClient(appPath) {
+	try {
+		await fs.access(path.join(appPath, CLIENT_RELATIVE_PATH), constants.X_OK);
+		return true;
+	} catch {
+		return false;
+	}
+}
+async function copyServiceAppWithDitto(sourcePath, targetPath) {
+	await runExec("/usr/bin/ditto", [
+		"--noqtn",
+		sourcePath,
+		targetPath
+	], {
+		logOutput: false,
+		timeoutMs: COPY_TIMEOUT_MS
+	});
+}
+//#endregion
+//#region extensions/codex/src/app-server/protocol.ts
+/** Namespace Codex keeps directly model-visible without exposing it to Code Mode guests. */
+const CODEX_OPENCLAW_DIRECT_DYNAMIC_TOOL_NAMESPACE = "openclaw_direct";
+function flattenCodexDynamicToolFunctions(tools) {
+	return (tools ?? []).flatMap((tool) => tool.type === "namespace" ? tool.tools : [tool]);
+}
+const CODEX_INTERACTIVE_THREAD_SOURCE_KINDS = ["cli", "vscode"];
+const CODEX_INTERACTIVE_CUSTOM_THREAD_SOURCES = ["atlas", "chatgpt"];
+function isJsonObject$1(value) {
 	return Boolean(value && typeof value === "object" && !Array.isArray(value));
 }
-/** Returns true for errors that mean the app-server transport is closed. */
-function isCodexAppServerConnectionClosedError(error) {
-	if (!(error instanceof Error)) return false;
-	if (isCodexAppServerIndeterminateTransportError(error)) return true;
-	return error.message === "codex app-server client is closed" || error.message.startsWith("codex app-server exited:");
+function isRpcResponse(message) {
+	return "id" in message && !("method" in message);
 }
-/** Stateful app-server JSON-RPC client over stdio or websocket transport. */
-var CodexAppServerClient = class CodexAppServerClient {
-	constructor(child) {
-		this.instanceId = randomUUID();
-		this.pending = /* @__PURE__ */ new Map();
-		this.requestHandlers = /* @__PURE__ */ new Set();
-		this.notificationHandlers = /* @__PURE__ */ new Set();
-		this.closeHandlers = /* @__PURE__ */ new Set();
-		this.nextId = 1;
-		this.initialized = false;
-		this.closed = false;
-		this.transportExited = false;
-		this.stderrTail = "";
-		this.child = child;
-		this.lines = createInterface({ input: child.stdout });
-		this.lines.on("line", (line) => this.handleLine(line));
-		this.lines.on("error", (error) => this.closeWithError(error instanceof Error ? error : new Error(String(error))));
-		child.stdout.on("error", (error) => this.closeWithError(error instanceof Error ? error : new Error(String(error))));
-		child.stderr.setEncoding("utf8");
-		child.stderr.on("data", (text) => {
-			this.stderrTail = appendBoundedTail(this.stderrTail, text, CODEX_APP_SERVER_STDERR_TAIL_MAX);
-			const trimmed = text.trim();
-			if (trimmed) embeddedAgentLog.debug(`codex app-server stderr: ${trimmed}`);
-		});
-		child.stderr.on("error", (error) => {
-			embeddedAgentLog.warn("codex app-server stderr stream failed", { error });
-		});
-		child.once("error", (error) => this.closeWithError(error instanceof Error ? error : new Error(String(error))));
-		child.once("exit", (code, signal) => {
-			this.transportExited = true;
-			this.closeWithError(buildCodexAppServerExitError(code, signal, this.stderrTail));
-		});
-		child.stdin.on?.("error", (error) => this.closeWithError(error instanceof Error ? error : new Error(String(error))));
-	}
-	/** Starts a new app-server client using resolved runtime start options. */
-	static start(options) {
-		const defaults = resolveCodexAppServerRuntimeOptions().start;
-		const startOptions = {
-			...defaults,
-			...options,
-			headers: options?.headers ?? defaults.headers
+//#endregion
+//#region extensions/codex/src/app-server/auth-bridge.ts
+const CODEX_APP_SERVER_AUTH_PROVIDER = "openai";
+const OPENAI_CODEX_APP_SERVER_AUTH_PROVIDER = "openai-codex";
+const LEGACY_CODEX_APP_SERVER_AUTH_PROVIDER = "codex-cli";
+const CODEX_APP_SERVER_EXTERNAL_CLI_PROVIDER_IDS = [CODEX_APP_SERVER_AUTH_PROVIDER, LEGACY_CODEX_APP_SERVER_AUTH_PROVIDER];
+const OPENAI_PROVIDER = "openai";
+const OPENAI_CODEX_DEFAULT_PROFILE_ID = "openai:default";
+const CODEX_HOME_ENV_VAR = "CODEX_HOME";
+const HOME_ENV_VAR = "HOME";
+const CODEX_API_KEY_ENV_VAR = "CODEX_API_KEY";
+const OPENAI_API_KEY_ENV_VAR = "OPENAI_API_KEY";
+const CODEX_ACCESS_TOKEN_ENV_VAR = "CODEX_ACCESS_TOKEN";
+const CODEX_APP_SERVER_API_KEY_ENV_VARS = [CODEX_API_KEY_ENV_VAR, OPENAI_API_KEY_ENV_VAR];
+const CODEX_APP_SERVER_PREPARED_AUTH_ENV_VARS = [
+	CODEX_API_KEY_ENV_VAR,
+	OPENAI_API_KEY_ENV_VAR,
+	CODEX_ACCESS_TOKEN_ENV_VAR
+];
+const CODEX_APP_SERVER_HOME_ENV_VARS = [CODEX_HOME_ENV_VAR, HOME_ENV_VAR];
+const CODEX_AUTH_JSON_FILENAME = "auth.json";
+const CODEX_HOME_DIRNAME = ".codex";
+const scopedOAuthRefreshQueues = /* @__PURE__ */ new WeakMap();
+async function bridgeCodexAppServerStartOptions(params) {
+	if (params.startOptions.transport !== "stdio") return params.startOptions;
+	const scopedStartOptions = await withCodexHomeEnvironment(withEphemeralCodexAuthStore(params), params.agentDir, params.pluginConfig);
+	if (params.preparedAuth) return withClearedEnvironmentVariables(scopedStartOptions, CODEX_APP_SERVER_PREPARED_AUTH_ENV_VARS);
+	if (params.authProfileId === null) return scopedStartOptions;
+	const store = resolveCodexAppServerAuthProfileStore({
+		agentDir: params.agentDir,
+		authProfileId: params.authProfileId,
+		authProfileStore: params.authProfileStore,
+		config: params.config
+	});
+	return shouldClearOpenAiApiKeyForCodexAuthProfile({
+		store,
+		authProfileId: resolveCodexAppServerAuthProfileId({
+			authProfileId: params.authProfileId,
+			store,
+			config: params.config
+		}),
+		config: params.config
+	}) ? withClearedEnvironmentVariables(scopedStartOptions, CODEX_APP_SERVER_API_KEY_ENV_VARS) : scopedStartOptions;
+}
+function resolveCodexAppServerAuthProfileId(params) {
+	const requested = params.authProfileId?.trim();
+	if (requested) return requested;
+	return resolveAuthProfileOrder({
+		cfg: params.config,
+		store: params.store,
+		provider: CODEX_APP_SERVER_AUTH_PROVIDER
+	})[0]?.trim();
+}
+function resolveCodexAppServerAuthProfileIdForAgent(params) {
+	const store = resolveCodexAppServerAuthProfileStore({
+		agentDir: params.agentDir?.trim() || resolveDefaultAgentDir(params.config ?? {}),
+		authProfileId: params.authProfileId,
+		authProfileStore: params.authProfileStore,
+		config: params.config
+	});
+	return resolveCodexAppServerAuthProfileId({
+		authProfileId: params.authProfileId,
+		store,
+		config: params.config
+	});
+}
+function ensureCodexAppServerAuthProfileStore(params) {
+	return ensureAuthProfileStore(params.agentDir, {
+		allowKeychainPrompt: false,
+		config: params.config,
+		externalCliProviderIds: CODEX_APP_SERVER_EXTERNAL_CLI_PROVIDER_IDS,
+		...params.authProfileId ? { externalCliProfileIds: [params.authProfileId] } : {}
+	});
+}
+function resolveCodexAppServerAuthProfileStore(params) {
+	if (params.authProfileStore) return params.authProfileStore;
+	return ensureCodexAppServerAuthProfileStore({
+		agentDir: params.agentDir,
+		authProfileId: params.authProfileId,
+		config: params.config
+	});
+}
+/** Resolves prepared profile login material once so cache identity and RPC login cannot drift. */
+async function resolveCodexAppServerPreparedAuthProfileSnapshot(params) {
+	const agentDir = params.agentDir?.trim() || resolveDefaultAgentDir(params.config ?? {});
+	const store = resolveCodexAppServerAuthProfileStore({
+		agentDir,
+		authProfileId: params.authProfileId,
+		authProfileStore: params.authProfileStore,
+		config: params.config
+	});
+	const profileId = resolveCodexAppServerAuthProfileId({
+		authProfileId: params.authProfileId,
+		store,
+		config: params.config
+	});
+	if (!profileId) return;
+	const credential = store.profiles[profileId];
+	if (!credential || !isCodexAppServerAuthProfileCredential(credential, params.config)) return;
+	const loginParams = await resolveCodexAppServerAuthProfileLoginParamsInternal({
+		agentDir,
+		authProfileId: profileId,
+		authProfileStore: store,
+		config: params.config
+	});
+	if (!loginParams) return;
+	const accountId = loginParams.type === "chatgptAuthTokens" ? loginParams.chatgptAccountId : resolveChatgptAccountId(profileId, credential);
+	const stableChatgptAccountId = resolveStableChatgptAccountId(credential);
+	return {
+		loginParams,
+		secretFreeCacheKey: credential.type === "api_key" && loginParams.type === "apiKey" ? `${accountId}:${fingerprintApiKeyAuthProfileCacheKey(loginParams.apiKey)}` : loginParams.type === "chatgptAuthTokens" && (credential.type === "token" || !stableChatgptAccountId) ? `${accountId}:${fingerprintTokenAuthProfileCacheKey(loginParams.accessToken)}` : accountId
+	};
+}
+/** Maps one prepared route to one mutually exclusive app-server auth handoff. */
+async function resolveCodexAppServerPreparedAuthHandoff(params) {
+	const usesNativeHome = params.homeScope === "user";
+	if (params.authRequirement === "api-key" && !usesNativeHome) {
+		const apiKey = params.resolvedApiKey?.trim();
+		if (!apiKey) throw new Error("Prepared Codex API-key route is missing its resolved API key.");
+		return {
+			nativeAuthProfile: false,
+			preparedAuth: {
+				kind: "api-key",
+				apiKey
+			}
 		};
-		if (startOptions.transport === "stdio" && startOptions.commandSource === "managed") throw new Error("Managed Codex app-server start options must be resolved before spawn.");
-		if (startOptions.transport === "websocket" || startOptions.transport === "unix") return new CodexAppServerClient(createWebSocketTransport(startOptions));
-		return new CodexAppServerClient(createStdioTransport(startOptions));
 	}
-	/** Builds a client around a fake transport for tests. */
-	static fromTransportForTests(child) {
-		return new CodexAppServerClient(child);
+	const authProfileId = params.authProfileId?.trim() || void 0;
+	const nativeAuthProfile = isCodexAppServerNativeAuthProfile({
+		authProfileId,
+		authProfileStore: params.authProfileStore,
+		agentDir: params.agentDir,
+		config: params.config
+	});
+	if (usesNativeHome || params.authRequirement !== "subscription") return {
+		authProfileId,
+		nativeAuthProfile
+	};
+	if (!authProfileId || !nativeAuthProfile) throw createCodexAppServerAuthError(params.subscriptionProfileRequiredError);
+	const snapshot = await resolveCodexAppServerPreparedAuthProfileSnapshot({
+		authProfileId,
+		authProfileStore: params.authProfileStore,
+		agentDir: params.agentDir,
+		config: params.config
+	});
+	if (!snapshot) throw createCodexAppServerAuthError(params.subscriptionProfileUnusableError);
+	return {
+		authProfileId,
+		nativeAuthProfile,
+		preparedAuth: {
+			kind: "profile",
+			profileId: authProfileId,
+			store: params.authProfileStore,
+			snapshot
+		}
+	};
+}
+async function resolveCodexAppServerAuthAccountCacheKey(params) {
+	const agentDir = params.agentDir?.trim() || resolveDefaultAgentDir(params.config ?? {});
+	const store = resolveCodexAppServerAuthProfileStore({
+		agentDir,
+		authProfileId: params.authProfileId,
+		authProfileStore: params.authProfileStore,
+		config: params.config
+	});
+	const profileId = resolveCodexAppServerAuthProfileId({
+		authProfileId: params.authProfileId,
+		store,
+		config: params.config
+	});
+	if (!profileId) return;
+	const credential = store.profiles[profileId];
+	if (!credential || !isCodexAppServerAuthProfileCredential(credential, params.config)) return;
+	if (credential.type === "api_key") {
+		const apiKey = (await resolveApiKeyForProfile({
+			store,
+			profileId,
+			agentDir
+		}))?.apiKey?.trim();
+		return apiKey ? `${resolveChatgptAccountId(profileId, credential)}:${fingerprintApiKeyAuthProfileCacheKey(apiKey)}` : resolveChatgptAccountId(profileId, credential);
 	}
-	/** Performs the app-server initialize handshake and validates protocol version. */
-	async initialize() {
-		if (this.initialized) return;
-		const response = await this.request("initialize", {
-			clientInfo: {
-				name: "openclaw",
-				title: "OpenClaw",
-				version: OPENCLAW_VERSION
-			},
-			capabilities: { experimentalApi: true }
-		});
-		this.serverVersion = assertSupportedCodexAppServerVersion(response);
-		this.runtimeIdentity = buildCodexAppServerRuntimeIdentity(response, this.serverVersion);
-		this.notify("initialized");
-		this.initialized = true;
-	}
-	/** Returns the version detected during initialize. */
-	getServerVersion() {
-		return this.serverVersion;
-	}
-	/** Returns runtime metadata detected during initialize. */
-	getRuntimeIdentity() {
-		return this.runtimeIdentity ? { ...this.runtimeIdentity } : void 0;
-	}
-	/** Stable generation id for this exact physical client instance. */
-	getInstanceId() {
-		return this.instanceId;
-	}
-	/** Installs the spawn-owner check run before config-loading thread requests. */
-	setThreadSessionRequestGuard(guard) {
-		this.threadSessionRequestGuard = guard;
+	if (credential.type === "token") {
+		const accessToken = (await resolveApiKeyForProfile({
+			store,
+			profileId,
+			agentDir
+		}))?.apiKey?.trim();
+		return accessToken ? `${resolveChatgptAccountId(profileId, credential)}:${fingerprintTokenAuthProfileCacheKey(accessToken)}` : resolveChatgptAccountId(profileId, credential);
 	}
-	/** Returns the local transport PID for scoped child-process cleanup, when available. */
-	getTransportPid() {
-		return this.child.pid;
+	return resolveChatgptAccountId(profileId, credential);
+}
+function resolveCodexAppServerEnvApiKeyCacheKey(params) {
+	if (params.startOptions.transport !== "stdio") return;
+	const apiKey = readFirstNonEmptyEnvEntry(resolveCodexAppServerSpawnEnv(params.startOptions, params.baseEnv ?? process.env, params.platform ?? process.platform), CODEX_APP_SERVER_API_KEY_ENV_VARS);
+	if (!apiKey) return;
+	const hash = createHash("sha256");
+	hash.update("openclaw:codex:app-server-env-api-key:v1");
+	hash.update("\0");
+	hash.update(apiKey.key);
+	hash.update("\0");
+	hash.update(apiKey.value);
+	return `${apiKey.key}:sha256:${hash.digest("hex")}`;
+}
+function resolveCodexAppServerFallbackApiKeyCacheKey(params) {
+	if (params.startOptions.transport !== "stdio") return;
+	return resolveCodexAppServerEnvApiKeyCacheKey(params) ?? resolveCodexCliAuthFileApiKeyCacheKey(params.baseEnv ?? process.env);
+}
+/** Secret-free cache identity for an API key already resolved by the runtime plan. */
+function resolveCodexAppServerPreparedApiKeyCacheKey(apiKey) {
+	const resolved = apiKey?.trim();
+	return resolved ? fingerprintApiKeyAuthProfileCacheKey(resolved) : void 0;
+}
+function fingerprintApiKeyAuthProfileCacheKey(apiKey) {
+	const hash = createHash("sha256");
+	hash.update("openclaw:codex:app-server-auth-profile-api-key:v1");
+	hash.update("\0");
+	hash.update(apiKey);
+	return `api_key:sha256:${hash.digest("hex")}`;
+}
+function fingerprintTokenAuthProfileCacheKey(accessToken) {
+	const hash = createHash("sha256");
+	hash.update("openclaw:codex:app-server-auth-profile-token:v1");
+	hash.update("\0");
+	hash.update(accessToken);
+	return `token:sha256:${hash.digest("hex")}`;
+}
+function fingerprintCodexCliAuthFileApiKeyCacheKey(apiKey) {
+	const hash = createHash("sha256");
+	hash.update("openclaw:codex:app-server-cli-auth-json-api-key:v1");
+	hash.update("\0");
+	hash.update(apiKey);
+	return `CODEX_AUTH_JSON:sha256:${hash.digest("hex")}`;
+}
+async function withCodexHomeEnvironment(startOptions, agentDir, pluginConfig) {
+	const codexHome = startOptions.env?.[CODEX_HOME_ENV_VAR]?.trim() ? startOptions.env[CODEX_HOME_ENV_VAR] : startOptions.homeScope === "user" ? resolveCodexAppServerUserHomeDir(process.env) : resolveCodexAppServerHomeDir(agentDir);
+	const nativeHome = startOptions.env?.[HOME_ENV_VAR]?.trim() ? startOptions.env[HOME_ENV_VAR] : void 0;
+	await fs.mkdir(codexHome, { recursive: true });
+	const computerUseConfig = resolveCodexComputerUseConfig({ pluginConfig });
+	await ensureCodexComputerUseSharedPluginCache({
+		codexHome,
+		config: computerUseConfig
+	});
+	if (computerUseConfig.enabled && computerUseConfig.autoInstall) try {
+		await ensureCodexComputerUseServiceApp({
+			codexHome,
+			appServerCommand: startOptions.command
+		});
+	} catch (error) {
+		throw new AgentHarnessPreflightError("Codex Computer Use client provisioning failed.", { cause: error });
 	}
-	request(method, params, optionsInput) {
-		let options = optionsInput;
-		options ??= {};
-		if (this.closed) return Promise.reject(this.closeError ?? /* @__PURE__ */ new Error("codex app-server client is closed"));
-		if (options.signal?.aborted) return Promise.reject(new CodexAppServerLocalRequestCancellationError(method, "aborted", false));
-		const guard = method === "thread/start" || method === "thread/resume" || method === "thread/fork" ? this.threadSessionRequestGuard : void 0;
-		if (guard) {
-			if (!options.signal && !(options.timeoutMs !== void 0 && Number.isFinite(options.timeoutMs) && options.timeoutMs > 0)) return Promise.reject(/* @__PURE__ */ new TypeError(`${method} requires a positive finite timeout or abort signal`));
-			return (async () => {
-				const guardStartedAt = Date.now();
-				const timeoutMessage = `${method} timed out`;
-				const abortMessage = `${method} aborted`;
-				let releaseGuard;
-				try {
-					releaseGuard = await guard({
-						signal: options.signal,
-						timeoutMs: options.timeoutMs,
-						timeoutMessage,
-						abortMessage
-					});
-				} catch (error) {
-					if (error instanceof Error && error.message === timeoutMessage) throw new CodexAppServerLocalRequestCancellationError(method, "timed out", false);
-					if (error instanceof Error && error.message === abortMessage) throw new CodexAppServerLocalRequestCancellationError(method, "aborted", false);
-					throw error;
-				}
-				let released = false;
-				const release = () => {
-					if (released) return;
-					released = true;
-					releaseGuard();
-				};
-				let releaseWhenRequestSettles = true;
-				let requestMayHaveWritten = false;
-				try {
-					const elapsedMs = Date.now() - guardStartedAt;
-					const remainingTimeoutMs = options.timeoutMs === void 0 ? void 0 : options.timeoutMs - elapsedMs;
-					if (remainingTimeoutMs !== void 0 && remainingTimeoutMs <= 0) throw new CodexAppServerLocalRequestCancellationError(method, "timed out", false);
-					return await this.requestWithoutThreadSessionGuard(method, params, {
-						...options,
-						...remainingTimeoutMs !== void 0 ? { timeoutMs: remainingTimeoutMs } : {}
-					}, () => {
-						requestMayHaveWritten = true;
-					});
-				} catch (error) {
-					if (requestMayHaveWritten && !(error instanceof CodexAppServerRpcError)) {
-						releaseWhenRequestSettles = false;
-						await this.closeAndRunAfterExit(release, method);
-					}
-					throw error;
-				} finally {
-					if (releaseWhenRequestSettles) release();
-				}
-			})();
+	if (nativeHome) await fs.mkdir(nativeHome, { recursive: true });
+	const nextStartOptions = {
+		...startOptions,
+		env: {
+			...startOptions.env,
+			[CODEX_HOME_ENV_VAR]: codexHome,
+			...nativeHome ? { [HOME_ENV_VAR]: nativeHome } : {}
 		}
-		return this.requestWithoutThreadSessionGuard(method, params, options);
+	};
+	const clearEnv = withoutClearedCodexHomeEnv(startOptions.clearEnv);
+	if (clearEnv) nextStartOptions.clearEnv = clearEnv;
+	else delete nextStartOptions.clearEnv;
+	return nextStartOptions;
+}
+function withoutClearedCodexHomeEnv(clearEnv) {
+	if (!clearEnv) return;
+	const reserved = new Set(CODEX_APP_SERVER_HOME_ENV_VARS);
+	const filtered = clearEnv.filter((envVar) => !reserved.has(envVar.trim().toUpperCase()));
+	return filtered.length === clearEnv.length ? clearEnv : filtered;
+}
+async function applyCodexAppServerAuthProfile(params) {
+	if (params.preparedAuth?.kind === "profile") {
+		await params.client.request("account/login/start", params.preparedAuth.snapshot.loginParams);
+		return;
 	}
-	requestWithoutThreadSessionGuard(method, params, options, onWriteAttempt) {
-		return this.requestWithOverloadRetry(method, params, options, onWriteAttempt);
+	if (params.preparedAuth?.kind === "api-key") {
+		await params.client.request("account/login/start", {
+			type: "apiKey",
+			apiKey: params.preparedAuth.apiKey
+		});
+		return;
 	}
-	async requestWithOverloadRetry(method, params, options, onWriteAttempt) {
-		const deadline = options.timeoutMs !== void 0 && Number.isFinite(options.timeoutMs) ? Date.now() + options.timeoutMs : void 0;
-		for (let retry = 0;; retry += 1) {
-			if (options.signal?.aborted) throw new CodexAppServerLocalRequestCancellationError(method, "aborted", false);
-			const remainingTimeoutMs = deadline === void 0 ? void 0 : deadline - Date.now();
-			if (remainingTimeoutMs !== void 0 && remainingTimeoutMs <= 0) throw new CodexAppServerLocalRequestCancellationError(method, "timed out", false);
-			try {
-				return await this.requestOnce(method, params, {
-					...options,
-					...remainingTimeoutMs !== void 0 ? { timeoutMs: remainingTimeoutMs } : {}
-				}, onWriteAttempt);
-			} catch (error) {
-				if (!(error instanceof CodexAppServerRpcError) || error.code !== CODEX_APP_SERVER_OVERLOADED_ERROR_CODE || retry >= CODEX_APP_SERVER_OVERLOAD_MAX_RETRIES) throw error;
-				const backoffMs = Math.round(CODEX_APP_SERVER_OVERLOAD_RETRY_BASE_MS * 2 ** retry * (.75 + Math.random() * .5));
-				await this.waitForOverloadRetry(method, backoffMs, deadline, options.signal);
-			}
+	if (params.authProfileId === null) {
+		if (params.authRequirement === "subscription") {
+			const response = await params.client.request("account/read", { refreshToken: false });
+			if (!isJsonObject$1(response.account) || response.account.type !== "chatgpt") throw createCodexAppServerAuthError("Codex subscription auth profile could not produce login credentials.");
 		}
+		return;
 	}
-	async waitForOverloadRetry(method, backoffMs, deadline, signal) {
-		if (signal?.aborted) throw new CodexAppServerLocalRequestCancellationError(method, "aborted", false);
-		const remainingMs = deadline === void 0 ? void 0 : deadline - Date.now();
-		if (remainingMs !== void 0 && remainingMs <= 0) throw new CodexAppServerLocalRequestCancellationError(method, "timed out", false);
-		const delayMs = remainingMs === void 0 ? backoffMs : Math.min(backoffMs, remainingMs);
-		await new Promise((resolve, reject) => {
-			const timer = setTimeout(() => {
-				cleanup();
-				resolve();
-			}, delayMs);
-			timer.unref?.();
-			const abortListener = () => {
-				cleanup();
-				reject(new CodexAppServerLocalRequestCancellationError(method, "aborted", false));
-			};
-			const cleanup = () => {
-				clearTimeout(timer);
-				signal?.removeEventListener("abort", abortListener);
-			};
-			signal?.addEventListener("abort", abortListener, { once: true });
-			if (signal?.aborted) abortListener();
+	let loginParams;
+	try {
+		loginParams = await resolveCodexAppServerAuthProfileLoginParams({
+			agentDir: params.agentDir,
+			authProfileId: params.authProfileId,
+			authProfileStore: params.authProfileStore,
+			config: params.config
 		});
+	} catch (error) {
+		if (params.authRequirement === "subscription" && error instanceof CodexAppServerAuthProfileUnavailableError) throw createCodexAppServerAuthError("Codex subscription auth profile could not produce login credentials.", error);
+		throw error;
 	}
-	requestOnce(method, params, options, onWriteAttempt) {
-		if (this.closed) return Promise.reject(this.closeError ?? /* @__PURE__ */ new Error("codex app-server client is closed"));
-		if (options.signal?.aborted) return Promise.reject(new CodexAppServerLocalRequestCancellationError(method, "aborted", false));
-		const id = this.nextId++;
-		const message = {
-			id,
-			method,
-			params
-		};
-		return new Promise((resolve, reject) => {
-			let timeout;
-			let cleanupAbort;
-			let mayHaveWritten = false;
-			const cleanup = () => {
-				if (timeout) {
-					clearTimeout(timeout);
-					timeout = void 0;
-				}
-				cleanupAbort?.();
-				cleanupAbort = void 0;
-			};
-			const rejectPending = (error) => {
-				if (!this.pending.has(id)) return;
-				this.pending.delete(id);
-				cleanup();
-				reject(mayHaveWritten && !(error instanceof CodexAppServerRpcError) && !isCodexAppServerIndeterminateRequestCancellationError(error) && !isCodexAppServerIndeterminateTransportError(error) ? new CodexAppServerIndeterminateTransportError(method, error) : error);
-			};
-			if (options.timeoutMs && Number.isFinite(options.timeoutMs) && options.timeoutMs > 0) {
-				timeout = setTimeout(() => rejectPending(new CodexAppServerLocalRequestCancellationError(method, "timed out", mayHaveWritten)), Math.max(100, options.timeoutMs));
-				timeout.unref?.();
-			}
-			if (options.signal) {
-				const abortListener = () => rejectPending(new CodexAppServerLocalRequestCancellationError(method, "aborted", mayHaveWritten));
-				options.signal.addEventListener("abort", abortListener, { once: true });
-				cleanupAbort = () => options.signal?.removeEventListener("abort", abortListener);
-			}
-			this.pending.set(id, {
-				method,
-				resolve: (value) => {
-					cleanup();
-					resolve(value);
-				},
-				reject: (error) => {
-					cleanup();
-					reject(mayHaveWritten && !(error instanceof CodexAppServerRpcError) && !isCodexAppServerIndeterminateRequestCancellationError(error) && !isCodexAppServerIndeterminateTransportError(error) ? new CodexAppServerIndeterminateTransportError(method, error) : error);
-				},
-				cleanup
-			});
-			if (options.signal?.aborted) {
-				rejectPending(new CodexAppServerLocalRequestCancellationError(method, "aborted", false));
-				return;
-			}
-			try {
-				mayHaveWritten = true;
-				onWriteAttempt?.();
-				this.writeMessage(message, (error) => rejectPending(error));
-			} catch (error) {
-				rejectPending(error instanceof Error ? error : new Error(String(error)));
-			}
+	if (params.authRequirement === "subscription" && loginParams?.type !== "chatgptAuthTokens") throw createCodexAppServerAuthError("Codex subscription auth profile could not produce login credentials.");
+	if (!loginParams) {
+		if (params.authRequirement === "subscription") throw createCodexAppServerAuthError("Codex subscription auth profile could not produce login credentials.");
+		if (params.authRequirement !== "api-key" || params.startOptions?.transport !== "stdio") return;
+		const env = resolveCodexAppServerSpawnEnv(params.startOptions, process.env);
+		const fallbackLoginParams = await resolveCodexAppServerFallbackApiKeyLoginParams({
+			client: params.client,
+			env,
+			codexCliAuthEnv: process.env
 		});
+		if (fallbackLoginParams) await params.client.request("account/login/start", fallbackLoginParams);
+		return;
 	}
-	/** Sends a fire-and-forget JSON-RPC notification to the app-server. */
-	notify(method, params) {
-		this.writeMessage({
-			method,
-			params
-		});
+	await params.client.request("account/login/start", loginParams);
+}
+function createCodexAppServerAuthError(message, cause) {
+	const error = cause === void 0 ? new Error(message) : new Error(message, { cause });
+	return Object.assign(error, { status: 401 });
+}
+var CodexAppServerAuthProfileUnavailableError = class extends Error {};
+async function resolveCodexAppServerAuthProfileLoginParams(params) {
+	const store = resolveCodexAppServerAuthProfileStore(params);
+	const profileId = resolveCodexAppServerAuthProfileId({
+		authProfileId: params.authProfileId,
+		store,
+		config: params.config
+	});
+	const profile = profileId ? store.profiles[profileId] : void 0;
+	if (profileId && !profile) throw new CodexAppServerAuthProfileUnavailableError(`Codex app-server auth profile "${profileId}" was not found.`);
+	if (profileId && profile && !isCodexAppServerAuthProfileCredential(profile, params.config)) throw new CodexAppServerAuthProfileUnavailableError(`Codex app-server auth profile "${profileId}" must be OpenAI Codex auth or an OpenAI API-key backup.`);
+	return await resolveCodexAppServerAuthProfileLoginParamsInternal({
+		...params,
+		authProfileStore: store
+	});
+}
+async function refreshCodexAppServerAuthTokens(params) {
+	const loginParams = await resolveCodexAppServerAuthProfileLoginParamsInternal({
+		...params,
+		forceOAuthRefresh: true
+	});
+	if (!loginParams || loginParams.type !== "chatgptAuthTokens") throw new Error("Codex app-server ChatGPT token refresh requires an OAuth auth profile.");
+	return {
+		accessToken: loginParams.accessToken,
+		chatgptAccountId: loginParams.chatgptAccountId,
+		chatgptPlanType: loginParams.chatgptPlanType ?? null
+	};
+}
+async function resolveCodexAppServerAuthProfileLoginParamsInternal(params) {
+	const store = resolveCodexAppServerAuthProfileStore({
+		agentDir: params.agentDir,
+		authProfileId: params.authProfileId,
+		authProfileStore: params.authProfileStore,
+		config: params.config
+	});
+	const profileId = resolveCodexAppServerAuthProfileId({
+		authProfileId: params.authProfileId,
+		store,
+		config: params.config
+	});
+	if (!profileId) return;
+	const credential = store.profiles[profileId];
+	if (!credential) throw new Error(`Codex app-server auth profile "${profileId}" was not found.`);
+	if (!isCodexAppServerAuthProfileCredential(credential, params.config)) throw new Error(`Codex app-server auth profile "${profileId}" must be OpenAI Codex auth or an OpenAI API-key backup.`);
+	const loginParams = await resolveLoginParamsForCredential(profileId, credential, {
+		agentDir: params.agentDir,
+		store,
+		preferStoreCredential: Boolean(params.authProfileStore?.profiles[profileId]),
+		forceOAuthRefresh: params.forceOAuthRefresh === true,
+		config: params.config
+	});
+	if (!loginParams) throw new CodexAppServerAuthProfileUnavailableError(`Codex app-server auth profile "${profileId}" does not contain usable credentials.`);
+	return loginParams;
+}
+async function resolveCodexAppServerFallbackApiKeyLoginParams(params) {
+	const apiKey = readFirstNonEmptyEnv(params.env, CODEX_APP_SERVER_API_KEY_ENV_VARS) ?? await readCodexCliAuthFileApiKey(params.codexCliAuthEnv);
+	if (!apiKey) return;
+	if ((await params.client.request("account/read", { refreshToken: false })).account) return;
+	return {
+		type: "apiKey",
+		apiKey
+	};
+}
+function resolveCodexCliAuthFilePath(env) {
+	const configuredCodexHome = env[CODEX_HOME_ENV_VAR]?.trim();
+	if (configuredCodexHome) return path.join(resolveHomeRelativePath(configuredCodexHome, env), CODEX_AUTH_JSON_FILENAME);
+	const home = env[HOME_ENV_VAR]?.trim() || env.USERPROFILE?.trim() || os.homedir();
+	return path.join(home, CODEX_HOME_DIRNAME, CODEX_AUTH_JSON_FILENAME);
+}
+function resolveHomeRelativePath(value, env) {
+	if (value === "~" || value.startsWith("~/") || value.startsWith("~\\")) {
+		const home = env[HOME_ENV_VAR]?.trim() || env.USERPROFILE?.trim() || os.homedir();
+		return path.join(home, value.slice(value === "~" ? 1 : 2));
 	}
-	/** Registers a handler for app-server requests sent back to OpenClaw. */
-	addRequestHandler(handler) {
-		this.requestHandlers.add(handler);
-		return () => this.requestHandlers.delete(handler);
+	return value;
+}
+function parseCodexCliAuthFileApiKey(raw) {
+	let parsed;
+	try {
+		parsed = JSON.parse(raw);
+	} catch {
+		return;
 	}
-	/** Registers a notification handler and returns its disposer. */
-	addNotificationHandler(handler) {
-		this.notificationHandlers.add(handler);
-		return () => this.notificationHandlers.delete(handler);
+	if (!parsed || typeof parsed !== "object") return;
+	const apiKey = parsed.OPENAI_API_KEY;
+	return typeof apiKey === "string" && apiKey.trim() ? apiKey.trim() : void 0;
+}
+async function readCodexCliAuthFileApiKey(env) {
+	try {
+		return parseCodexCliAuthFileApiKey(await fs.readFile(resolveCodexCliAuthFilePath(env), "utf8"));
+	} catch {
+		return;
 	}
-	/** Registers a close handler and returns its disposer. */
-	addCloseHandler(handler) {
-		this.closeHandlers.add(handler);
-		return () => this.closeHandlers.delete(handler);
+}
+function resolveCodexCliAuthFileApiKeyCacheKey(env) {
+	try {
+		const apiKey = parseCodexCliAuthFileApiKey(fsSync.readFileSync(resolveCodexCliAuthFilePath(env), "utf8"));
+		return apiKey ? fingerprintCodexCliAuthFileApiKeyCacheKey(apiKey) : void 0;
+	} catch {
+		return;
 	}
-	/** Closes the transport without waiting for process/socket shutdown. */
-	close() {
-		if (!this.markClosed(/* @__PURE__ */ new Error("codex app-server client is closed"))) return;
-		closeCodexAppServerTransport(this.child);
+}
+async function resolveLoginParamsForCredential(profileId, credential, params) {
+	if (credential.type === "api_key") {
+		const apiKey = (await resolveApiKeyForProfile({
+			store: params.preferStoreCredential ? params.store : ensureAuthProfileStore(params.agentDir, { allowKeychainPrompt: false }),
+			profileId,
+			agentDir: params.agentDir
+		}))?.apiKey?.trim();
+		return apiKey ? {
+			type: "apiKey",
+			apiKey
+		} : void 0;
 	}
-	/** Closes the transport and waits for shutdown according to transport policy. */
-	async closeAndWait(options) {
-		this.markClosed(/* @__PURE__ */ new Error("codex app-server client is closed"));
-		return await closeCodexAppServerTransportAndWait(this.child, options);
+	if (credential.type === "token") {
+		const accessToken = (await resolveApiKeyForProfile({
+			store: params.preferStoreCredential ? params.store : ensureAuthProfileStore(params.agentDir, { allowKeychainPrompt: false }),
+			profileId,
+			agentDir: params.agentDir
+		}))?.apiKey?.trim();
+		return accessToken ? buildChatgptAuthTokensParams(profileId, credential, accessToken) : void 0;
 	}
-	/** Closes this transport and runs cleanup only after physical process exit. */
-	async closeAndRunAfterExit(onExit, operation) {
-		let settled = false;
-		const runOnExit = () => {
-			if (settled) return;
-			settled = true;
-			onExit();
-		};
-		if (this.transportExited) {
-			runOnExit();
-			return;
-		}
-		this.child.once("exit", runOnExit);
-		try {
-			if (await this.closeAndWait()) {
-				this.child.off?.("exit", runOnExit);
-				runOnExit();
-			}
-		} catch (closeError) {
-			embeddedAgentLog.warn("codex app-server shutdown after indeterminate request failed", {
-				closeError,
-				operation
-			});
-		}
+	if (credential.type !== "oauth") return;
+	const resolvedCredential = await resolveOAuthCredentialForCodexAppServer(profileId, credential, {
+		agentDir: params.agentDir,
+		store: params.store,
+		preferStoreCredential: params.preferStoreCredential,
+		forceRefresh: params.forceOAuthRefresh,
+		config: params.config
+	});
+	const accessToken = resolvedCredential.access?.trim();
+	return accessToken ? buildChatgptAuthTokensParams(profileId, resolvedCredential, accessToken) : void 0;
+}
+async function resolveOAuthCredentialForCodexAppServer(profileId, credential, params) {
+	const ownerAgentDir = resolvePersistedAuthProfileOwnerAgentDir({
+		agentDir: params.agentDir,
+		profileId
+	});
+	const persistedCredential = findPersistedAuthProfileCredential({
+		agentDir: ownerAgentDir,
+		profileId
+	});
+	const useScopedCredential = params.preferStoreCredential && shouldUseScopedOAuthCredential({
+		store: params.store,
+		profileId,
+		persistedCredential,
+		suppliedCredential: credential,
+		config: params.config
+	});
+	const store = useScopedCredential ? params.store : ensureCodexAppServerAuthProfileStore({
+		agentDir: ownerAgentDir,
+		authProfileId: profileId,
+		config: params.config
+	});
+	const persistedOAuthCredential = !useScopedCredential && persistedCredential?.type === "oauth" && isCodexAppServerAuthProvider(persistedCredential.provider, params.config) ? persistedCredential : void 0;
+	const ownerCredential = store.profiles[profileId];
+	const overlaidOAuthCredential = ownerCredential?.type === "oauth" && isCodexAppServerAuthProvider(ownerCredential.provider, params.config) ? ownerCredential : void 0;
+	if (useScopedCredential && overlaidOAuthCredential) return await resolveScopedOAuthCredential({
+		store,
+		profileId,
+		credential: overlaidOAuthCredential,
+		forceRefresh: params.forceRefresh
+	});
+	if (params.forceRefresh && !persistedOAuthCredential && overlaidOAuthCredential) {
+		const refreshedRuntimeCredential = await refreshOAuthCredentialForRuntime({ credential: overlaidOAuthCredential });
+		if (!refreshedRuntimeCredential?.access?.trim()) throw new Error(`Codex app-server auth profile "${profileId}" could not refresh.`);
+		store.profiles[profileId] = refreshedRuntimeCredential;
+		return refreshedRuntimeCredential;
 	}
-	writeMessage(message, onError) {
-		if (this.closed) return;
-		const id = "id" in message ? message.id : void 0;
-		const method = "method" in message ? message.method : void 0;
-		this.child.stdin.write(`${stringifyCodexAppServerMessage(message)}\n`, (error) => {
-			if (error) {
-				embeddedAgentLog.warn("codex app-server write failed", {
-					error,
-					id,
-					method
-				});
-				onError?.(error);
-			}
-		});
+	const resolved = await resolveApiKeyForProfile({
+		store,
+		profileId,
+		agentDir: ownerAgentDir,
+		forceRefresh: params.forceRefresh && Boolean(persistedOAuthCredential)
+	});
+	const refreshed = useScopedCredential ? void 0 : loadAuthProfileStoreForSecretsRuntime(ownerAgentDir).profiles[profileId];
+	const refreshedOAuthCredential = refreshed?.type === "oauth" && isCodexAppServerAuthProvider(refreshed.provider, params.config) ? refreshed : void 0;
+	if (refreshedOAuthCredential && isDeepStrictEqual(params.store.profiles[profileId], credential)) params.store.profiles[profileId] = refreshedOAuthCredential;
+	const storedCredential = store.profiles[profileId];
+	const candidate = refreshedOAuthCredential ? refreshedOAuthCredential : storedCredential?.type === "oauth" && isCodexAppServerAuthProvider(storedCredential.provider, params.config) ? storedCredential : credential;
+	return resolved?.apiKey ? {
+		...candidate,
+		access: resolved.apiKey
+	} : candidate;
+}
+function shouldUseScopedOAuthCredential(params) {
+	if (!params.store.runtimePersistedProfileIds?.includes(params.profileId)) return true;
+	const persisted = params.persistedCredential;
+	if (persisted?.type !== "oauth") return true;
+	if (resolveProviderIdForAuth(persisted.provider, { config: params.config }) !== resolveProviderIdForAuth(params.suppliedCredential.provider, { config: params.config })) return true;
+	return !isDeepStrictEqual(persisted, params.suppliedCredential) && !hasMatchingOAuthIdentity(persisted, params.suppliedCredential);
+}
+function hasMatchingOAuthIdentity(persisted, supplied) {
+	const persistedAccountId = persisted.accountId?.trim();
+	const suppliedAccountId = supplied.accountId?.trim();
+	if (persistedAccountId && suppliedAccountId) return persistedAccountId === suppliedAccountId;
+	const persistedEmail = persisted.email?.trim().toLowerCase();
+	const suppliedEmail = supplied.email?.trim().toLowerCase();
+	return Boolean(persistedEmail && suppliedEmail && persistedEmail === suppliedEmail);
+}
+async function resolveScopedOAuthCredential(params) {
+	const existingRefresh = scopedOAuthRefreshQueues.get(params.store)?.get(params.profileId);
+	if (existingRefresh) return await existingRefresh;
+	if (!params.forceRefresh && hasUsableOAuthCredential(params.credential)) return params.credential;
+	const storeRefreshes = scopedOAuthRefreshQueues.get(params.store) ?? /* @__PURE__ */ new Map();
+	scopedOAuthRefreshQueues.set(params.store, storeRefreshes);
+	const refresh = (async () => {
+		const current = params.store.profiles[params.profileId];
+		const credential = current?.type === "oauth" ? current : params.credential;
+		if (!params.forceRefresh && hasUsableOAuthCredential(credential)) return credential;
+		const refreshed = await refreshOAuthCredentialForRuntime({ credential });
+		if (!refreshed?.access?.trim()) throw new Error(`Codex app-server auth profile "${params.profileId}" could not refresh.`);
+		if (!isDeepStrictEqual(params.store.profiles[params.profileId], credential)) throw new Error(`Codex app-server auth profile "${params.profileId}" changed while refreshing.`);
+		params.store.profiles[params.profileId] = refreshed;
+		return refreshed;
+	})();
+	storeRefreshes.set(params.profileId, refresh);
+	try {
+		return await refresh;
+	} finally {
+		if (storeRefreshes.get(params.profileId) === refresh) storeRefreshes.delete(params.profileId);
 	}
-	handleLine(line) {
-		const rawLine = line.endsWith("\r") ? line.slice(0, -1) : line;
-		if (this.pendingParse) {
-			this.handlePendingParseLine(rawLine);
-			return;
-		}
-		const trimmed = rawLine.trim();
-		if (!trimmed) return;
-		let parsed;
-		try {
-			parsed = JSON.parse(trimmed);
-		} catch (error) {
-			if (shouldBufferCodexAppServerParseFailure(trimmed, error)) {
-				this.pendingParse = {
-					text: trimmed,
-					lineCount: 1,
-					firstError: error
-				};
-				return;
-			}
-			logCodexAppServerParseFailure(trimmed, error, 1);
-			return;
-		}
-		this.handleParsedMessage(parsed);
+}
+function isCodexAppServerAuthProvider(provider, config) {
+	const resolvedProvider = resolveProviderIdForAuth(provider, { config });
+	return resolvedProvider === CODEX_APP_SERVER_AUTH_PROVIDER || resolvedProvider === OPENAI_CODEX_APP_SERVER_AUTH_PROVIDER || resolvedProvider === LEGACY_CODEX_APP_SERVER_AUTH_PROVIDER;
+}
+function isOpenAIApiKeyBackupCredential(credential, config) {
+	return credential.type === "api_key" && resolveProviderIdForAuth(credential.provider, { config }) === OPENAI_PROVIDER;
+}
+function isCodexAppServerAuthProfileCredential(credential, config) {
+	return isCodexAppServerAuthProvider(credential.provider, config) || isOpenAIApiKeyBackupCredential(credential, config);
+}
+function shouldClearOpenAiApiKeyForCodexAuthProfile(params) {
+	const profileId = params.authProfileId?.trim();
+	return isCodexSubscriptionCredential(profileId ? params.store.profiles[profileId] : params.store.profiles[OPENAI_CODEX_DEFAULT_PROFILE_ID], params.config);
+}
+function isCodexSubscriptionCredential(credential, config) {
+	if (!credential || !isCodexAppServerAuthProvider(credential.provider, config)) return false;
+	return credential.type === "oauth" || credential.type === "token";
+}
+function withClearedEnvironmentVariables(startOptions, envVars) {
+	const clearEnv = startOptions.clearEnv ?? [];
+	const missingEnvVars = envVars.filter((envVar) => !clearEnv.includes(envVar));
+	if (missingEnvVars.length === 0) return startOptions;
+	return {
+		...startOptions,
+		clearEnv: [...clearEnv, ...missingEnvVars]
+	};
+}
+function readFirstNonEmptyEnv(env, keys) {
+	return readFirstNonEmptyEnvEntry(env, keys)?.value;
+}
+function readFirstNonEmptyEnvEntry(env, keys) {
+	for (const key of keys) {
+		const value = env[key]?.trim();
+		if (value) return {
+			key,
+			value
+		};
 	}
-	handlePendingParseLine(line) {
-		const pending = this.pendingParse;
-		if (!pending) return;
-		const candidate = `${pending.text}\\n${line}`;
-		let parsed;
-		try {
-			parsed = JSON.parse(candidate);
-		} catch (error) {
-			const lineCount = pending.lineCount + 1;
-			if (shouldBufferCodexAppServerParseFailure(candidate.trim(), error) && candidate.length <= CODEX_APP_SERVER_PARSE_BUFFER_MAX && lineCount <= CODEX_APP_SERVER_PARSE_BUFFER_MAX_LINES) {
-				this.pendingParse = {
-					text: candidate,
-					lineCount,
-					firstError: pending.firstError
-				};
-				return;
-			}
-			this.pendingParse = void 0;
-			logCodexAppServerParseFailure(candidate, error, lineCount);
-			return;
-		}
-		this.pendingParse = void 0;
-		this.handleParsedMessage(parsed);
+}
+function buildChatgptAuthTokensParams(profileId, credential, accessToken) {
+	return {
+		type: "chatgptAuthTokens",
+		accessToken,
+		chatgptAccountId: resolveChatgptAccountId(profileId, credential),
+		chatgptPlanType: resolveChatgptPlanType(credential)
+	};
+}
+function resolveChatgptPlanType(credential) {
+	const record = credential;
+	const planType = record.chatgptPlanType ?? record.planType;
+	return typeof planType === "string" && planType.trim() ? planType.trim() : null;
+}
+function resolveChatgptAccountId(profileId, credential) {
+	return resolveStableChatgptAccountId(credential) ?? profileId;
+}
+function resolveStableChatgptAccountId(credential) {
+	if ("accountId" in credential && typeof credential.accountId === "string") {
+		const accountId = credential.accountId.trim();
+		if (accountId) return accountId;
 	}
-	handleParsedMessage(parsed) {
-		if (!parsed || typeof parsed !== "object") return;
-		const message = parsed;
-		if (isRpcResponse(message)) {
-			this.handleResponse(message);
-			return;
-		}
-		if (!("method" in message)) return;
-		if ("id" in message && message.id !== void 0) {
-			this.handleServerRequest({
-				id: message.id,
-				method: message.method,
-				params: message.params
-			});
-			return;
-		}
-		this.handleNotification({
-			method: message.method,
-			params: message.params
+	return credential.email?.trim() || void 0;
+}
+//#endregion
+//#region extensions/codex/src/app-server/rate-limit-cache.ts
+const DEFAULT_CODEX_RATE_LIMIT_CACHE_MAX_AGE_MS = 10 * 6e4;
+const SPARSE_ACCOUNT_METADATA_KEYS = [
+	"credits",
+	"individualLimit",
+	"planType"
+];
+const rateLimitsByClient = /* @__PURE__ */ new WeakMap();
+/** Replaces one physical client's cache with an authoritative rate-limit read response. */
+function rememberCodexRateLimitsRead(client, value, nowMs = Date.now()) {
+	if (value !== void 0) {
+		const revisionsByLimitId = { ...rateLimitsByClient.get(client)?.revisionsByLimitId };
+		for (const limitId of readRateLimitIds(value)) revisionsByLimitId[limitId] = (revisionsByLimitId[limitId] ?? 0) + 1;
+		rateLimitsByClient.set(client, {
+			value,
+			updatedAtMs: nowMs,
+			revisionsByLimitId
 		});
 	}
-	handleResponse(response) {
-		const pending = this.pending.get(response.id);
-		if (!pending) return;
-		this.pending.delete(response.id);
-		if (response.error) {
-			pending.reject(new CodexAppServerRpcError(response.error, pending.method));
-			return;
+}
+/** Merges a sparse rolling notification into one physical client's latest read response. */
+function mergeCodexRateLimitsUpdate(client, value, nowMs = Date.now()) {
+	const update = isJsonObject$1(value) && isJsonObject$1(value.rateLimits) ? value.rateLimits : void 0;
+	if (!update) return;
+	const currentState = rateLimitsByClient.get(client);
+	const current = currentState?.value;
+	const limitId = readLimitId(update);
+	rateLimitsByClient.set(client, {
+		value: mergeRateLimitUpdate(current, update),
+		updatedAtMs: nowMs,
+		revisionsByLimitId: {
+			...currentState?.revisionsByLimitId,
+			[limitId]: (currentState?.revisionsByLimitId[limitId] ?? 0) + 1
 		}
-		pending.resolve(response.result);
-	}
-	async handleServerRequest(request) {
-		try {
-			const result = await this.runServerRequestHandlers(request);
-			if (result !== void 0) {
-				this.writeMessage({
-					id: request.id,
-					result
-				});
-				return;
-			}
-			this.writeMessage({
-				id: request.id,
-				result: defaultServerRequestResponse(request)
-			});
-		} catch (error) {
-			const message = error instanceof Error ? error.message : String(error);
-			embeddedAgentLog.warn("codex app-server server request handler failed", {
-				id: request.id,
-				method: request.method,
-				error
-			});
-			this.writeMessage({
-				id: request.id,
-				error: {
-					code: -32603,
-					message
-				}
-			});
-		}
-	}
-	async runServerRequestHandlers(request) {
-		const controller = new AbortController();
-		const timeoutResponse = timeoutServerRequestResponse(request);
-		if (!timeoutResponse) return await this.runServerRequestHandlersWithoutTimeout(request, controller.signal);
-		let timeout;
-		try {
-			return await Promise.race([this.runServerRequestHandlersWithoutTimeout(request, controller.signal), new Promise((resolve) => {
-				timeout = setTimeout(() => {
-					embeddedAgentLog.warn("codex app-server server request timed out", {
-						id: request.id,
-						method: request.method,
-						timeoutMs: CODEX_DYNAMIC_TOOL_SERVER_REQUEST_TIMEOUT_MS
-					});
-					controller.abort(/* @__PURE__ */ new Error("codex app-server server request timed out"));
-					resolve(timeoutResponse);
-				}, CODEX_DYNAMIC_TOOL_SERVER_REQUEST_TIMEOUT_MS);
-				timeout.unref?.();
-			})]);
-		} finally {
-			if (timeout) clearTimeout(timeout);
-		}
-	}
-	async runServerRequestHandlersWithoutTimeout(request, signal) {
-		for (const handler of this.requestHandlers) {
-			if (signal.aborted) return;
-			const result = await handler(request, signal);
-			if (result !== void 0) return result;
-		}
-	}
-	handleNotification(notification) {
-		for (const handler of this.notificationHandlers) Promise.resolve(handler(notification)).catch((error) => {
-			embeddedAgentLog.warn("codex app-server notification handler failed", { error });
-		});
-	}
-	closeWithError(error) {
-		if (this.markClosed(error)) closeCodexAppServerTransport(this.child);
-	}
-	markClosed(error) {
-		if (this.closed) return false;
-		this.closed = true;
-		this.closeError = error;
-		this.lines.close();
-		this.rejectPendingRequests(error);
-		return true;
-	}
-	rejectPendingRequests(error) {
-		for (const pending of this.pending.values()) {
-			pending.cleanup();
-			pending.reject(error);
-		}
-		this.pending.clear();
-		for (const handler of this.closeHandlers) handler(this);
-	}
-};
-function defaultServerRequestResponse(request) {
-	if (request.method === "item/tool/call") return {
-		contentItems: [{
-			type: "inputText",
-			text: "OpenClaw did not register a handler for this app-server tool call."
-		}],
-		success: false
-	};
-	if (request.method === "item/commandExecution/requestApproval" || request.method === "item/fileChange/requestApproval") return { decision: "decline" };
-	if (request.method === "item/permissions/requestApproval") return {
-		permissions: {},
-		scope: "turn"
-	};
-	if (request.method === "item/tool/requestUserInput") return { answers: {} };
-	if (request.method === "mcpServer/elicitation/request") return { action: "decline" };
-	return {};
+	});
 }
-function stringifyCodexAppServerMessage(message) {
-	return JSON.stringify(message, (_key, value) => typeof value === "string" ? value.replace(UNPAIRED_SURROGATE_RE, "") : value) ?? "null";
+/** Per-limit marker used to trust only primary Codex updates from one turn startup. */
+function readCodexRateLimitsRevision(client, limitId = "codex") {
+	return rateLimitsByClient.get(client)?.revisionsByLimitId[limitId] ?? 0;
 }
-function timeoutServerRequestResponse(request) {
-	if (request.method !== "item/tool/call") return;
+/** Reads one physical client's cached rate-limit payload within the max-age window. */
+function readRecentCodexRateLimits(client, options) {
+	const state = rateLimitsByClient.get(client);
+	if (!state) return;
+	const nowMs = options?.nowMs ?? Date.now();
+	const maxAgeMs = options?.maxAgeMs ?? DEFAULT_CODEX_RATE_LIMIT_CACHE_MAX_AGE_MS;
+	return maxAgeMs >= 0 && nowMs - state.updatedAtMs > maxAgeMs ? void 0 : state.value;
+}
+function mergeRateLimitUpdate(current, update) {
+	const currentEnvelope = isJsonObject$1(current) ? current : void 0;
+	const currentPrimary = currentEnvelope && isJsonObject$1(currentEnvelope.rateLimits) ? currentEnvelope.rateLimits : void 0;
+	const currentByLimitId = currentEnvelope && isJsonObject$1(currentEnvelope.rateLimitsByLimitId) ? currentEnvelope.rateLimitsByLimitId : void 0;
+	const limitId = readLimitId(update);
+	const currentPrimaryLimitId = currentPrimary ? readLimitId(currentPrimary) : void 0;
+	const currentForLimit = (currentByLimitId && isJsonObject$1(currentByLimitId[limitId]) ? currentByLimitId[limitId] : void 0) ?? (currentPrimaryLimitId === limitId ? currentPrimary : void 0);
+	const merged = mergeSparseSnapshot(isJsonObject$1(currentForLimit) ? currentForLimit : void 0, currentPrimary, update, limitId);
+	const nextPrimary = !currentPrimary || currentPrimaryLimitId === limitId ? merged : currentPrimary;
+	let nextByLimitId;
+	if (currentByLimitId) nextByLimitId = {
+		...currentByLimitId,
+		[limitId]: merged
+	};
+	else if (currentPrimary && currentPrimaryLimitId && currentPrimaryLimitId !== limitId) nextByLimitId = {
+		[currentPrimaryLimitId]: currentPrimary,
+		[limitId]: merged
+	};
 	return {
-		contentItems: [{
-			type: "inputText",
-			text: `OpenClaw dynamic tool call timed out after ${CODEX_DYNAMIC_TOOL_SERVER_REQUEST_TIMEOUT_MS}ms before sending a response to Codex.`
-		}],
-		success: false
+		...currentEnvelope,
+		rateLimits: nextPrimary,
+		...nextByLimitId ? { rateLimitsByLimitId: nextByLimitId } : {}
 	};
 }
-/** Raised when the initialize handshake detects an unsupported app-server version. */
-var CodexAppServerVersionError = class extends Error {
-	constructor(detectedVersion) {
-		const detected = detectedVersion ? `detected ${detectedVersion}` : "OpenClaw could not determine the running Codex version";
-		super(`A stable Codex app-server from ${MIN_CODEX_APP_SERVER_VERSION} through ${MAX_CODEX_APP_SERVER_VERSION} is required, but ${detected}. Update the configured Codex app-server binary, or remove custom command overrides to use the managed binary.`);
-		this.name = "CodexAppServerVersionError";
-		this.detectedVersion = detectedVersion;
+function readRateLimitIds(value) {
+	if (!isJsonObject$1(value)) return [];
+	const ids = /* @__PURE__ */ new Set();
+	if (isJsonObject$1(value.rateLimits)) ids.add(readLimitId(value.rateLimits));
+	if (isJsonObject$1(value.rateLimitsByLimitId)) for (const [key, snapshot] of Object.entries(value.rateLimitsByLimitId)) {
+		const snapshotLimitId = isJsonObject$1(snapshot) && typeof snapshot.limitId === "string" ? snapshot.limitId.trim() : "";
+		ids.add(snapshotLimitId || key);
 	}
-};
-function assertSupportedCodexAppServerVersion(response) {
-	const detectedVersion = readCodexVersionFromUserAgent(response.userAgent);
-	const parsedVersion = parse(detectedVersion ?? "");
-	if (!detectedVersion || !parsedVersion || parsedVersion.compare("0.143.0") < 0 || parsedVersion.compare("0.145.0") > 0 || parsedVersion.prerelease.length > 0 || parsedVersion.build.length > 0) throw new CodexAppServerVersionError(detectedVersion);
-	return detectedVersion;
-}
-function isUnsupportedCodexAppServerVersionError(error) {
-	return error instanceof CodexAppServerVersionError;
+	return [...ids];
 }
-function buildCodexAppServerRuntimeIdentity(response, serverVersion) {
-	const userAgent = readNonEmptyInitializeString(response.userAgent);
-	const codexHome = readNonEmptyInitializeString(response.codexHome);
-	const platformFamily = readNonEmptyInitializeString(response.platformFamily);
-	const platformOs = readNonEmptyInitializeString(response.platformOs);
-	return {
-		serverVersion,
-		...userAgent ? { userAgent } : {},
-		...codexHome ? { codexHome } : {},
-		...platformFamily ? { platformFamily } : {},
-		...platformOs ? { platformOs } : {}
+function mergeSparseSnapshot(current, accountFallback, update, limitId) {
+	const merged = {
+		...update,
+		limitId
 	};
+	for (const key of SPARSE_ACCOUNT_METADATA_KEYS) {
+		const previous = current?.[key] ?? accountFallback?.[key];
+		if (merged[key] == null && previous != null) merged[key] = previous;
+	}
+	return merged;
 }
-function readNonEmptyInitializeString(value) {
-	const trimmed = value?.trim();
-	return trimmed ? trimmed : void 0;
-}
-/** Extracts the Codex version from the app-server initialize user-agent field. */
-function readCodexVersionFromUserAgent(userAgent) {
-	return (userAgent?.match(/^[^/]+\/(\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?)(?:[\s(]|$)/))?.[1];
-}
-function redactCodexAppServerLinePreview(value) {
-	const redacted = value.replace(/\s+/g, " ").trim().replace(/(Bearer\s+)[A-Za-z0-9._~+/-]+/gi, "$1<redacted>").replace(/("(?:api_?key|authorization|token|access_token|refresh_token)"\s*:\s*")([^"]+)(")/gi, "$1<redacted>$3").replace(/\b([a-z0-9_]*(?:api_?key|authorization|access_token|refresh_token|token))(\s*=\s*)(["']?)[^\s"']+(\3)/gi, "$1$2$3<redacted>$4");
-	return redacted.length > CODEX_APP_SERVER_PARSE_LOG_MAX ? `${truncateUtf16Safe(redacted, CODEX_APP_SERVER_PARSE_LOG_MAX)}...` : redacted;
-}
-function appendBoundedTail(current, next, maxLength) {
-	const combined = `${current}${next}`;
-	return combined.length > maxLength ? sliceUtf16Safe(combined, -maxLength) : combined;
-}
-function buildCodexAppServerExitError(code, signal, stderrTail) {
-	const stderrPreview = redactCodexAppServerLinePreview(stderrTail);
-	const suffix = stderrPreview ? ` stderr=${JSON.stringify(stderrPreview)}` : "";
-	return /* @__PURE__ */ new Error(`codex app-server exited: code=${formatExitValue(code)} signal=${formatExitValue(signal)}${suffix}`);
-}
-function shouldBufferCodexAppServerParseFailure(value, error) {
-	if (!value.startsWith("{") && !value.startsWith("[")) return false;
-	const message = error instanceof Error ? error.message : String(error);
-	return message.includes("Unterminated string") || message.includes("Unexpected end of JSON input");
+function readLimitId(snapshot) {
+	const value = snapshot.limitId;
+	return typeof value === "string" && value.trim() ? value.trim() : "codex";
 }
-function logCodexAppServerParseFailure(value, error, fragmentCount) {
-	const linePreview = redactCodexAppServerLinePreview(value);
-	const suffix = fragmentCount > 1 ? ` fragments=${fragmentCount}` : "";
-	embeddedAgentLog.warn("failed to parse codex app-server message", {
-		error,
-		errorMessage: error instanceof Error ? error.message : String(error),
-		fragmentCount,
-		linePreview,
-		consoleMessage: `failed to parse codex app-server message${suffix}: preview=${JSON.stringify(linePreview)}`
+//#endregion
+//#region extensions/codex/src/app-server/client-runtime.ts
+/** Client-scoped Codex auth and account observers. */
+const configuredClients = /* @__PURE__ */ new WeakMap();
+/** Installs one auth-refresh handler and one rate-limit observer per physical client. */
+function ensureCodexAppServerClientRuntime(client, context) {
+	const existing = configuredClients.get(client);
+	if (existing) {
+		existing.context = context;
+		return;
+	}
+	const runtime = { context };
+	configuredClients.set(client, runtime);
+	client.addRequestHandler(async (request) => {
+		if (request.method !== "account/chatgptAuthTokens/refresh") return;
+		if (runtime.context.authMode === "prepared-api-key") throw new Error("ChatGPT token refresh is unavailable for prepared Codex API-key auth.");
+		return await refreshCodexAppServerAuthTokens({
+			agentDir: runtime.context.agentDir,
+			authProfileId: runtime.context.authProfileId,
+			...runtime.context.authProfileStore ? { authProfileStore: runtime.context.authProfileStore } : {},
+			config: runtime.context.config
+		});
+	});
+	client.addNotificationHandler((notification) => {
+		if (notification.method === "account/rateLimits/updated") mergeCodexRateLimitsUpdate(client, notification.params);
 	});
-}
-const CODEX_APP_SERVER_APPROVAL_REQUEST_METHODS = /* @__PURE__ */ new Set([
-	"item/commandExecution/requestApproval",
-	"item/fileChange/requestApproval",
-	"item/permissions/requestApproval"
-]);
-/** Returns true for app-server approval request methods OpenClaw can answer. */
-function isCodexAppServerApprovalRequest(method) {
-	return CODEX_APP_SERVER_APPROVAL_REQUEST_METHODS.has(method);
-}
-function formatExitValue(value) {
-	if (value === null || value === void 0) return "null";
-	if (typeof value === "string" || typeof value === "number") return String(value);
-	return "unknown";
 }
 //#endregion
-//#region extensions/codex/src/app-server/attempt-timeouts.ts
+//#region extensions/codex/src/app-server/transport-websocket.ts
 /**
-* Timeout defaults and normalizers for Codex app-server startup and turn
-* liveness watches.
+* Adapts a remote Codex app-server WebSocket endpoint to the shared stdio-like
+* transport interface.
 */
-/** Minimum startup timeout accepted by the Codex app-server harness. */
-const CODEX_APP_SERVER_STARTUP_TIMEOUT_FLOOR_MS = 100;
-/** Default idle timeout while waiting for app-server turn completion. */
-const CODEX_TURN_COMPLETION_IDLE_TIMEOUT_MS = 6e4;
-/** Short guard after apparent assistant completion. */
-const CODEX_TURN_ASSISTANT_COMPLETION_IDLE_TIMEOUT_MS = 1e4;
-const CODEX_POST_TOOL_RAW_ASSISTANT_COMPLETION_IDLE_TIMEOUT_MS = 5 * 6e4;
-/** Guard after reasoning/commentary progress when no tool handoff occurred. */
-const CODEX_POST_REASONING_REPLY_IDLE_TIMEOUT_MS = 5 * 6e4;
-/** Long terminal idle watch for app-server turns that never send completion. */
-const CODEX_TURN_TERMINAL_IDLE_TIMEOUT_MS = 30 * 6e4;
-var CodexAppServerStartupError = class extends Error {
-	constructor(reason, message = reason === "timed_out" ? "codex app-server startup timed out" : "codex app-server startup aborted") {
-		super(message);
-		this.reason = reason;
-		this.code = "CODEX_APP_SERVER_STARTUP_CANCELLED";
-		this.name = "CodexAppServerStartupError";
-	}
-};
-function isCodexAppServerStartupError(error, reason) {
-	return error instanceof Error && "code" in error && error.code === "CODEX_APP_SERVER_STARTUP_CANCELLED" && "reason" in error && (error.reason === "aborted" || error.reason === "timed_out") && (reason === void 0 || error.reason === reason);
+/** Opens a WebSocket app-server transport and maps newline-delimited frames to stdout/stdin. */
+function createWebSocketTransport(options) {
+	if (!options.url) throw new Error("codex app-server websocket transport requires plugins.entries.codex.config.appServer.url");
+	const events = new EventEmitter();
+	const stdout = new PassThrough();
+	const stderr = new PassThrough();
+	const websocketOptions = {
+		headers: {
+			...options.headers,
+			...options.authToken ? { Authorization: `Bearer ${options.authToken}` } : {}
+		},
+		perMessageDeflate: false
+	};
+	const unixSocketPath = resolveCodexAppServerUnixSocketPath(options);
+	const socket = unixSocketPath ? new WebSocket("ws://localhost/", {
+		...websocketOptions,
+		createConnection: () => connectCodexAppServerUnixSocket(unixSocketPath)
+	}) : new WebSocket(options.url, websocketOptions);
+	const pendingFrames = [];
+	const stdinDecoder = new StringDecoder("utf8");
+	let pendingLine = "";
+	let killed = false;
+	const sendFrame = (frame) => {
+		const trimmed = frame.trim();
+		if (!trimmed) return;
+		if (socket.readyState === WebSocket.OPEN) {
+			socket.send(trimmed);
+			return;
+		}
+		pendingFrames.push(trimmed);
+	};
+	socket.once("open", () => {
+		for (const frame of pendingFrames.splice(0)) socket.send(frame);
+	});
+	socket.once("error", (error) => events.emit("error", error));
+	socket.once("close", (code, reason) => {
+		killed = true;
+		events.emit("exit", code, reason.toString("utf8"));
+	});
+	socket.on("message", (data) => {
+		const text = websocketFrameToText(data);
+		stdout.write(text.endsWith("\n") ? text : `${text}\n`);
+	});
+	const stdin = new Writable({
+		write(chunk, _encoding, callback) {
+			pendingLine += stdinDecoder.write(chunk);
+			const lines = pendingLine.split("\n");
+			pendingLine = lines.pop() ?? "";
+			for (const frame of lines) sendFrame(frame);
+			callback();
+		},
+		final(callback) {
+			pendingLine += stdinDecoder.end();
+			if (pendingLine) sendFrame(pendingLine);
+			pendingLine = "";
+			callback();
+		}
+	});
+	const closeSocket = () => {
+		if (socket.readyState === WebSocket.CLOSED || socket.readyState === WebSocket.CLOSING) return;
+		socket.close();
+	};
+	stdin.once("finish", closeSocket);
+	stdin.once("close", closeSocket);
+	return {
+		stdin,
+		stdout,
+		stderr,
+		get killed() {
+			return killed;
+		},
+		kill: () => {
+			killed = true;
+			socket.close();
+		},
+		once: (event, listener) => events.once(event, listener)
+	};
 }
-function resolvePositiveIntegerTimeoutMs(value, fallbackMs) {
-	return resolveTimerTimeoutMs(value, resolveTimerTimeoutMs(fallbackMs, 1));
+/** Opens the owner-scoped Codex control socket used by the WebSocket upgrade. */
+function connectCodexAppServerUnixSocket(socketPath) {
+	return net.createConnection(socketPath);
 }
-/** Runs startup work with abort and timeout handling plus optional cleanup. */
-async function withCodexStartupTimeout(params) {
-	if (params.signal.aborted) throw new CodexAppServerStartupError("aborted");
-	let timeout;
-	let abortCleanup;
-	let timeoutError;
-	let timeoutCleanup;
-	try {
-		return await Promise.race([params.operation(), new Promise((_, reject) => {
-			const rejectOnce = (error) => {
-				if (timeout) {
-					clearTimeout(timeout);
-					timeout = void 0;
-				}
-				reject(error);
-			};
-			timeout = setTimeout(() => {
-				timeoutError = new CodexAppServerStartupError("timed_out");
-				timeoutCleanup = Promise.resolve(params.onTimeout?.()).then(() => void 0, () => void 0);
-				timeoutCleanup.finally(() => {
-					rejectOnce(timeoutError);
-				});
-			}, params.timeoutMs);
-			const abortListener = () => rejectOnce(new CodexAppServerStartupError("aborted"));
-			params.signal.addEventListener("abort", abortListener, { once: true });
-			abortCleanup = () => params.signal.removeEventListener("abort", abortListener);
-		})]);
-	} catch (error) {
-		if (timeoutError) {
-			await timeoutCleanup;
-			throw timeoutError;
-		}
-		throw error;
-	} finally {
-		if (timeout) clearTimeout(timeout);
-		abortCleanup?.();
+/** Resolves the canonical or explicitly configured Codex control socket. */
+function resolveCodexAppServerUnixSocketPath(options) {
+	if (options.transport !== "unix") {
+		if (options.url?.startsWith("unix://")) throw new Error("codex app-server unix URL requires unix transport");
+		return;
 	}
+	const url = options.url ?? "unix://";
+	if (!url.startsWith("unix://")) throw new Error("codex app-server unix transport requires a unix:// URL");
+	return url.slice(7) || path.join(resolveCodexAppServerUserHomeDir(options.env ?? process.env), "app-server-control", "app-server-control.sock");
 }
-/** Resolves startup timeout while honoring the configured floor. */
-function resolveCodexStartupTimeoutMs(params) {
-	const timeoutFloorMs = resolvePositiveIntegerTimeoutMs(params.timeoutFloorMs, CODEX_APP_SERVER_STARTUP_TIMEOUT_FLOOR_MS);
-	const timeoutMs = resolvePositiveIntegerTimeoutMs(params.timeoutMs, timeoutFloorMs);
-	return Math.max(timeoutFloorMs, timeoutMs);
+function websocketFrameToText(data) {
+	if (typeof data === "string") return data;
+	if (Buffer.isBuffer(data)) return data.toString("utf8");
+	if (Array.isArray(data)) return Buffer.concat(data).toString("utf8");
+	return Buffer.from(data).toString("utf8");
 }
-/** Resolves the completion-idle timeout for an active turn. */
-function resolveCodexTurnCompletionIdleTimeoutMs(value) {
-	return resolvePositiveIntegerTimeoutMs(value, CODEX_TURN_COMPLETION_IDLE_TIMEOUT_MS);
+//#endregion
+//#region extensions/codex/src/app-server/transport.ts
+/** Starts graceful transport shutdown and schedules a force kill fallback. */
+function closeCodexAppServerTransport(child, options = {}) {
+	child.stdin.end?.();
+	child.stdin.destroy?.();
+	const forceKillDelayMs = options.forceKillDelayMs ?? 1e3;
+	const forceKill = setTimeout(() => {
+		if (hasCodexAppServerTransportExited(child)) return;
+		signalCodexAppServerTransport(child, "SIGKILL");
+	}, Math.max(1, forceKillDelayMs));
+	forceKill.unref?.();
+	child.once("exit", () => {
+		clearTimeout(forceKill);
+		child.stdout.destroy?.();
+		child.stderr.destroy?.();
+	});
+	child.unref?.();
+	child.stdout.unref?.();
+	child.stderr.unref?.();
+	child.stdin.unref?.();
 }
-/** Resolves the short assistant-completion release timeout. */
-function resolveCodexTurnAssistantCompletionIdleTimeoutMs(value) {
-	return resolvePositiveIntegerTimeoutMs(value, CODEX_TURN_ASSISTANT_COMPLETION_IDLE_TIMEOUT_MS);
+/** Closes a transport and waits briefly for an exit event. */
+async function closeCodexAppServerTransportAndWait(child, options = {}) {
+	if (!hasCodexAppServerTransportExited(child)) closeCodexAppServerTransport(child, options);
+	return await waitForCodexAppServerTransportExit(child, options.exitTimeoutMs ?? 2e3);
 }
-/** Resolves the conservative post-tool raw assistant guard timeout. */
-function resolveCodexPostToolRawAssistantCompletionIdleTimeoutMs(value, fallbackMs) {
-	return resolvePositiveIntegerTimeoutMs(value, Math.max(resolvePositiveIntegerTimeoutMs(void 0, fallbackMs), CODEX_POST_TOOL_RAW_ASSISTANT_COMPLETION_IDLE_TIMEOUT_MS));
+function hasCodexAppServerTransportExited(child) {
+	return child.exitCode !== null && child.exitCode !== void 0 ? true : child.signalCode !== null && child.signalCode !== void 0;
 }
-/** Resolves the long terminal turn idle timeout. */
-function resolveCodexTurnTerminalIdleTimeoutMs(value, runTimeoutOverrideMs) {
-	const explicitRunBudgetMs = resolvePositiveIntegerTimeoutMs(runTimeoutOverrideMs, CODEX_TURN_TERMINAL_IDLE_TIMEOUT_MS);
-	return resolvePositiveIntegerTimeoutMs(value, Math.max(CODEX_TURN_TERMINAL_IDLE_TIMEOUT_MS, explicitRunBudgetMs));
+async function waitForCodexAppServerTransportExit(child, timeoutMs) {
+	if (hasCodexAppServerTransportExited(child)) return true;
+	return await new Promise((resolve) => {
+		let settled = false;
+		const onExit = () => {
+			if (settled) return;
+			settled = true;
+			clearTimeout(timeout);
+			resolve(true);
+		};
+		const timeout = setTimeout(() => {
+			if (settled) return;
+			settled = true;
+			child.off?.("exit", onExit);
+			resolve(false);
+		}, Math.max(1, timeoutMs));
+		child.once("exit", onExit);
+	});
 }
-/** Adds gateway grace time to a caller timeout without overflowing invalid values. */
-function resolveCodexGatewayTimeoutWithGraceMs(timeoutMs, graceMs = 1e4) {
-	const timeout = resolvePositiveIntegerTimeoutMs(timeoutMs, 1);
-	return addTimerTimeoutGraceMs(timeout, resolveTimerTimeoutMs(graceMs, 0, 0)) ?? timeout;
+function signalCodexAppServerTransport(child, signal) {
+	if (child.pid && process.platform !== "win32") try {
+		process.kill(-child.pid, signal);
+		return;
+	} catch {}
+	child.kill?.(signal);
 }
 //#endregion
-//#region extensions/codex/src/app-server/auth-start-options.ts
-const CODEX_APP_SERVER_HOME_DIRNAME = "codex-home";
-const CODEX_EPHEMERAL_AUTH_STORE_OVERRIDE = "cli_auth_credentials_store=\"ephemeral\"";
-function resolveCodexAppServerHomeDir(agentDir) {
-	return path.join(path.resolve(agentDir), CODEX_APP_SERVER_HOME_DIRNAME);
-}
-/** Forces OpenClaw-owned Codex auth to remain process-local. */
-function withEphemeralCodexAuthStore(params) {
-	const { startOptions } = params;
-	if (!(startOptions.commandSource === "managed" || startOptions.commandSource === "resolved-managed") || !params.preparedAuth && params.authProfileId === null) return startOptions;
-	if (startOptions.args.at(-2) === "-c" && startOptions.args.at(-1) === CODEX_EPHEMERAL_AUTH_STORE_OVERRIDE) return startOptions;
-	return {
-		...startOptions,
-		args: [
-			...startOptions.args,
-			"-c",
-			CODEX_EPHEMERAL_AUTH_STORE_OVERRIDE
-		]
-	};
-}
+//#region extensions/codex/src/app-server/version.ts
+/**
+* Version and package pins for the managed Codex app-server runtime.
+*/
+/** Minimum Codex app-server version supported by the OpenClaw Codex bridge. */
+const MIN_CODEX_APP_SERVER_VERSION = "0.143.0";
+/** Newest Codex app-server version validated by the OpenClaw Codex bridge. */
+const MAX_CODEX_APP_SERVER_VERSION = "0.145.0";
+/** npm package name for the managed Codex app-server binary. */
+const MANAGED_CODEX_APP_SERVER_PACKAGE = "@openai/codex";
 //#endregion
-//#region extensions/codex/src/app-server/desktop-app-paths.ts
-/** Shared path candidates for Codex's macOS desktop app bundle. */
-const MACOS_DESKTOP_CODEX_APP_PATH_CANDIDATES = [{
-	appName: "ChatGPT.app",
-	appBundlePath: "/Applications/ChatGPT.app",
-	appServerCommandPath: "/Applications/ChatGPT.app/Contents/Resources/codex",
-	bundledMarketplacePath: "/Applications/ChatGPT.app/Contents/Resources/plugins/openai-bundled"
-}, {
-	appName: "Codex.app",
-	appBundlePath: "/Applications/Codex.app",
-	appServerCommandPath: "/Applications/Codex.app/Contents/Resources/codex",
-	bundledMarketplacePath: "/Applications/Codex.app/Contents/Resources/plugins/openai-bundled"
-}];
-function resolveMacOSDesktopCodexBundledMarketplaceCandidates(platform = process.platform) {
-	return platform === "darwin" ? MACOS_DESKTOP_CODEX_APP_PATH_CANDIDATES.map((candidate) => candidate.bundledMarketplacePath) : [];
-}
-function resolveFirstExistingMacOSDesktopCodexBundledMarketplacePath(params = {}) {
-	const candidates = params.candidates ?? resolveMacOSDesktopCodexBundledMarketplaceCandidates(params.platform);
-	const pathExists = params.pathExists ?? existsSync;
-	return candidates.find((candidate) => pathExists(candidate));
-}
-//#endregion
-//#region extensions/codex/src/app-server/computer-use-cache.ts
-/** Shared Computer Use plugin cache reconciliation for isolated Codex homes. */
-const DEFAULT_CODEX_COMPUTER_USE_BUNDLED_MARKETPLACE_PATH = resolveMacOSDesktopCodexBundledMarketplaceCandidates("darwin")[0] ?? "";
-const DEFAULT_BUNDLED_MARKETPLACE_NAME = "openai-bundled";
-async function ensureCodexComputerUseSharedPluginCache(params) {
-	if (!params.config.enabled) return skippedCacheResult("disabled", "Computer Use cache sharing skipped because it is disabled.");
-	if (params.config.pluginCacheMode === "independent") return skippedCacheResult("independent", "Computer Use cache sharing skipped because pluginCacheMode is independent.");
-	if (params.config.marketplaceName || params.config.marketplacePath) return skippedCacheResult("explicit_marketplace", "Computer Use cache sharing skipped because an explicit marketplace is configured.");
-	const bundledMarketplacePath = resolveComputerUseBundledMarketplacePath(params);
-	const sourcePluginRoot = path.join(bundledMarketplacePath, "plugins", params.config.pluginName);
-	const version = await readBundledPluginVersion(sourcePluginRoot);
-	if (!version) return skippedCacheResult("source_missing", `Computer Use bundled plugin source was not found at ${sourcePluginRoot}.`);
-	const marketplaceName = params.config.marketplaceName ?? DEFAULT_BUNDLED_MARKETPLACE_NAME;
-	const cacheRoot = path.join(params.codexHome, "plugins", "cache", marketplaceName, params.config.pluginName);
-	const cachePath = path.join(cacheRoot, version);
-	return {
-		status: "shared",
-		changed: await ensureRealDirectoryCopy(cachePath, sourcePluginRoot, version),
-		cachePath,
-		targetPath: sourcePluginRoot,
-		version,
-		removedStaleVersions: [],
-		warnings: [],
-		message: `Computer Use plugin cache ${cachePath} contains bundled plugin ${sourcePluginRoot}.`
-	};
+//#region extensions/codex/src/app-server/client.ts
+/**
+* JSON-RPC client for Codex app-server transports, including request/response
+* routing, notification fanout, server request handlers, and version checks.
+*/
+/** Minimum supported Codex app-server version exported for callers/tests. */
+const CODEX_APP_SERVER_PARSE_LOG_MAX = 500;
+const CODEX_APP_SERVER_PARSE_BUFFER_MAX = 8 * 1024 * 1024;
+const CODEX_APP_SERVER_PARSE_BUFFER_MAX_LINES = 1e3;
+const CODEX_DYNAMIC_TOOL_SERVER_REQUEST_TIMEOUT_MS = 66e4;
+const CODEX_APP_SERVER_STDERR_TAIL_MAX = 2e3;
+const CODEX_APP_SERVER_OVERLOADED_ERROR_CODE = -32001;
+const CODEX_APP_SERVER_OVERLOAD_MAX_RETRIES = 3;
+const CODEX_APP_SERVER_OVERLOAD_RETRY_BASE_MS = 50;
+const CODEX_APP_SERVER_CLIENT_INSTANCE_IDS = /* @__PURE__ */ new WeakMap();
+const UNPAIRED_SURROGATE_RE = /[\uD800-\uDBFF](?![\uDC00-\uDFFF])|(?<![\uD800-\uDBFF])[\uDC00-\uDFFF]/g;
+/** Process-local generation fence for bindings tied to one app-server client instance. */
+function getCodexAppServerClientInstanceId(client) {
+	const current = CODEX_APP_SERVER_CLIENT_INSTANCE_IDS.get(client);
+	if (current) return current;
+	const created = randomUUID();
+	CODEX_APP_SERVER_CLIENT_INSTANCE_IDS.set(client, created);
+	return created;
 }
-function resolveComputerUseBundledMarketplacePath(params) {
-	return params.bundledMarketplacePath ?? resolveFirstExistingMacOSDesktopCodexBundledMarketplacePath({ candidates: params.bundledMarketplacePathCandidates }) ?? params.bundledMarketplacePathCandidates?.[0] ?? DEFAULT_CODEX_COMPUTER_USE_BUNDLED_MARKETPLACE_PATH;
+function resolveCodexAppServerClientInstanceId(client) {
+	return client.getInstanceId?.call(client) ?? getCodexAppServerClientInstanceId(client);
 }
-async function readBundledPluginVersion(sourcePluginRoot) {
-	const pluginJsonPath = path.join(sourcePluginRoot, ".codex-plugin", "plugin.json");
-	let raw;
-	try {
-		raw = await fs.readFile(pluginJsonPath, "utf8");
-	} catch {
-		return;
+/** RPC error wrapper that preserves app-server error code and data. */
+var CodexAppServerRpcError = class extends Error {
+	constructor(error, method) {
+		super(formatCodexAppServerRpcErrorMessage(error, method));
+		this.name = "CodexAppServerRpcError";
+		this.code = error.code;
+		this.data = error.data;
+		this.method = method;
 	}
-	try {
-		const parsed = JSON.parse(raw);
-		return typeof parsed.version === "string" && parsed.version.trim() ? parsed.version.trim() : void 0;
-	} catch {
-		return;
+};
+var CodexAppServerLocalRequestCancellationError = class extends Error {
+	constructor(method, reason, mayHaveWritten) {
+		super(`${method} ${reason}`);
+		this.reason = reason;
+		this.mayHaveWritten = mayHaveWritten;
+		this.code = "CODEX_APP_SERVER_LOCAL_REQUEST_CANCELLED";
+		this.name = "CodexAppServerLocalRequestCancellationError";
 	}
+};
+function isCodexAppServerRequestTimeoutError(error) {
+	return error instanceof Error && "code" in error && error.code === "CODEX_APP_SERVER_LOCAL_REQUEST_CANCELLED" && "reason" in error && error.reason === "timed out";
 }
-async function ensureRealDirectoryCopy(cachePath, sourcePluginRoot, version) {
-	await fs.mkdir(path.dirname(cachePath), { recursive: true });
-	const stat = await fs.lstat(cachePath).catch(() => void 0);
-	if (stat?.isDirectory() && !stat.isSymbolicLink()) {
-		if (await readBundledPluginVersion(cachePath) === version) return false;
-	}
-	const cacheRoot = path.dirname(cachePath);
-	const cacheName = path.basename(cachePath);
-	const stagingRoot = await fs.mkdtemp(path.join(cacheRoot, `.${cacheName}.staging-`));
-	const stagedPath = path.join(stagingRoot, cacheName);
-	const backupPath = path.join(cacheRoot, `.${cacheName}.backup-${process.pid}-${Date.now()}`);
-	let backupCreated = false;
-	try {
-		await fs.cp(sourcePluginRoot, stagedPath, { recursive: true });
-		if (stat) {
-			await fs.rename(cachePath, backupPath);
-			backupCreated = true;
-		}
-		try {
-			await fs.rename(stagedPath, cachePath);
-		} catch (error) {
-			if (backupCreated) try {
-				await fs.rename(backupPath, cachePath);
-				backupCreated = false;
-			} catch (restoreError) {
-				throw new Error(`Failed to install Computer Use cache ${cachePath} and restore its prior copy: ${String(error)}`, { cause: restoreError });
-			}
-			throw error;
-		}
-		if (backupCreated) await fs.rm(backupPath, {
-			recursive: true,
-			force: true
-		});
-		return true;
-	} finally {
-		await fs.rm(stagingRoot, {
-			recursive: true,
-			force: true
-		});
+function isCodexAppServerBrokenPipeError(error) {
+	const seen = /* @__PURE__ */ new Set();
+	let current = error;
+	while (current && typeof current === "object" && !seen.has(current)) {
+		seen.add(current);
+		if ("code" in current && current.code === "EPIPE") return true;
+		current = "cause" in current ? current.cause : void 0;
 	}
+	return false;
 }
-function skippedCacheResult(status, message) {
-	return {
-		status,
-		changed: false,
-		message,
-		removedStaleVersions: [],
-		warnings: status === "source_missing" ? [message] : []
-	};
+var CodexAppServerIndeterminateTransportError = class extends Error {
+	constructor(method, cause) {
+		super(`${method} transport failed after request write: ${cause.message}`, { cause });
+		this.code = "CODEX_APP_SERVER_REQUEST_TRANSPORT_INDETERMINATE";
+		this.mayHaveWritten = true;
+		this.name = "CodexAppServerIndeterminateTransportError";
+	}
+};
+/** True when a local cancellation can leave an app-server request in flight. */
+function isCodexAppServerIndeterminateRequestCancellationError(error) {
+	return error instanceof Error && "code" in error && error.code === "CODEX_APP_SERVER_LOCAL_REQUEST_CANCELLED" && "mayHaveWritten" in error && error.mayHaveWritten === true;
 }
-//#endregion
-//#region extensions/codex/src/app-server/auth-bridge.ts
-const CODEX_APP_SERVER_AUTH_PROVIDER = "openai";
-const OPENAI_CODEX_APP_SERVER_AUTH_PROVIDER = "openai-codex";
-const LEGACY_CODEX_APP_SERVER_AUTH_PROVIDER = "codex-cli";
-const CODEX_APP_SERVER_EXTERNAL_CLI_PROVIDER_IDS = [CODEX_APP_SERVER_AUTH_PROVIDER, LEGACY_CODEX_APP_SERVER_AUTH_PROVIDER];
-const OPENAI_PROVIDER = "openai";
-const OPENAI_CODEX_DEFAULT_PROFILE_ID = "openai:default";
-const CODEX_HOME_ENV_VAR = "CODEX_HOME";
-const HOME_ENV_VAR = "HOME";
-const CODEX_API_KEY_ENV_VAR = "CODEX_API_KEY";
-const OPENAI_API_KEY_ENV_VAR = "OPENAI_API_KEY";
-const CODEX_ACCESS_TOKEN_ENV_VAR = "CODEX_ACCESS_TOKEN";
-const CODEX_APP_SERVER_API_KEY_ENV_VARS = [CODEX_API_KEY_ENV_VAR, OPENAI_API_KEY_ENV_VAR];
-const CODEX_APP_SERVER_PREPARED_AUTH_ENV_VARS = [
-	CODEX_API_KEY_ENV_VAR,
-	OPENAI_API_KEY_ENV_VAR,
-	CODEX_ACCESS_TOKEN_ENV_VAR
-];
-const CODEX_APP_SERVER_HOME_ENV_VARS = [CODEX_HOME_ENV_VAR, HOME_ENV_VAR];
-const CODEX_AUTH_JSON_FILENAME = "auth.json";
-const CODEX_HOME_DIRNAME = ".codex";
-const scopedOAuthRefreshQueues = /* @__PURE__ */ new WeakMap();
-async function bridgeCodexAppServerStartOptions(params) {
-	if (params.startOptions.transport !== "stdio") return params.startOptions;
-	const scopedStartOptions = await withCodexHomeEnvironment(withEphemeralCodexAuthStore(params), params.agentDir, params.pluginConfig);
-	if (params.preparedAuth) return withClearedEnvironmentVariables(scopedStartOptions, CODEX_APP_SERVER_PREPARED_AUTH_ENV_VARS);
-	if (params.authProfileId === null) return scopedStartOptions;
-	const store = resolveCodexAppServerAuthProfileStore({
-		agentDir: params.agentDir,
-		authProfileId: params.authProfileId,
-		authProfileStore: params.authProfileStore,
-		config: params.config
-	});
-	return shouldClearOpenAiApiKeyForCodexAuthProfile({
-		store,
-		authProfileId: resolveCodexAppServerAuthProfileId({
-			authProfileId: params.authProfileId,
-			store,
-			config: params.config
-		}),
-		config: params.config
-	}) ? withClearedEnvironmentVariables(scopedStartOptions, CODEX_APP_SERVER_API_KEY_ENV_VARS) : scopedStartOptions;
+/** True when local cancellation happened before a request write was attempted. */
+function isCodexAppServerPrewriteRequestCancellationError(error) {
+	return error instanceof Error && "code" in error && error.code === "CODEX_APP_SERVER_LOCAL_REQUEST_CANCELLED" && "mayHaveWritten" in error && error.mayHaveWritten === false;
 }
-function resolveCodexAppServerAuthProfileId(params) {
-	const requested = params.authProfileId?.trim();
-	if (requested) return requested;
-	return resolveAuthProfileOrder({
-		cfg: params.config,
-		store: params.store,
-		provider: CODEX_APP_SERVER_AUTH_PROVIDER
-	})[0]?.trim();
+/** True when transport failure cannot prove a written request stopped running. */
+function isCodexAppServerIndeterminateTransportError(error) {
+	return error instanceof Error && "code" in error && error.code === "CODEX_APP_SERVER_REQUEST_TRANSPORT_INDETERMINATE" && "mayHaveWritten" in error && error.mayHaveWritten === true;
 }
-function resolveCodexAppServerAuthProfileIdForAgent(params) {
-	const store = resolveCodexAppServerAuthProfileStore({
-		agentDir: params.agentDir?.trim() || resolveDefaultAgentDir(params.config ?? {}),
-		authProfileId: params.authProfileId,
-		authProfileStore: params.authProfileStore,
-		config: params.config
-	});
-	return resolveCodexAppServerAuthProfileId({
-		authProfileId: params.authProfileId,
-		store,
-		config: params.config
-	});
+function formatCodexAppServerRpcErrorMessage(error, method) {
+	const message = error.message || `${method} failed`;
+	const detail = readCodexAppServerRpcReloginDetail(error.data);
+	return detail && !message.includes(detail) ? `${message}: ${detail}` : message;
 }
-function ensureCodexAppServerAuthProfileStore(params) {
-	return ensureAuthProfileStore(params.agentDir, {
-		allowKeychainPrompt: false,
-		config: params.config,
-		externalCliProviderIds: CODEX_APP_SERVER_EXTERNAL_CLI_PROVIDER_IDS,
-		...params.authProfileId ? { externalCliProfileIds: [params.authProfileId] } : {}
-	});
+function readCodexAppServerRpcReloginDetail(data) {
+	const record = isJsonObject(data) ? data : void 0;
+	const nested = isJsonObject(record?.error) ? record.error : record;
+	if (!nested) return;
+	const isRelogin = nested.action === "relogin" || nested.reason === "cloudRequirements" && nested.errorCode === "Auth";
+	const detail = typeof nested.detail === "string" ? nested.detail.trim() : "";
+	return isRelogin && detail ? detail : void 0;
 }
-function resolveCodexAppServerAuthProfileStore(params) {
-	if (params.authProfileStore) return params.authProfileStore;
-	return ensureCodexAppServerAuthProfileStore({
-		agentDir: params.agentDir,
-		authProfileId: params.authProfileId,
-		config: params.config
-	});
+function isJsonObject(value) {
+	return Boolean(value && typeof value === "object" && !Array.isArray(value));
 }
-/** Resolves prepared profile login material once so cache identity and RPC login cannot drift. */
-async function resolveCodexAppServerPreparedAuthProfileSnapshot(params) {
-	const agentDir = params.agentDir?.trim() || resolveDefaultAgentDir(params.config ?? {});
-	const store = resolveCodexAppServerAuthProfileStore({
-		agentDir,
-		authProfileId: params.authProfileId,
-		authProfileStore: params.authProfileStore,
-		config: params.config
-	});
-	const profileId = resolveCodexAppServerAuthProfileId({
-		authProfileId: params.authProfileId,
-		store,
-		config: params.config
-	});
-	if (!profileId) return;
-	const credential = store.profiles[profileId];
-	if (!credential || !isCodexAppServerAuthProfileCredential(credential, params.config)) return;
-	const loginParams = await resolveCodexAppServerAuthProfileLoginParamsInternal({
-		agentDir,
-		authProfileId: profileId,
-		authProfileStore: store,
-		config: params.config
-	});
-	if (!loginParams) return;
-	const accountId = loginParams.type === "chatgptAuthTokens" ? loginParams.chatgptAccountId : resolveChatgptAccountId(profileId, credential);
-	const stableChatgptAccountId = resolveStableChatgptAccountId(credential);
-	return {
-		loginParams,
-		secretFreeCacheKey: credential.type === "api_key" && loginParams.type === "apiKey" ? `${accountId}:${fingerprintApiKeyAuthProfileCacheKey(loginParams.apiKey)}` : loginParams.type === "chatgptAuthTokens" && (credential.type === "token" || !stableChatgptAccountId) ? `${accountId}:${fingerprintTokenAuthProfileCacheKey(loginParams.accessToken)}` : accountId
-	};
+/** Returns true for errors that mean the app-server transport is closed. */
+function isCodexAppServerConnectionClosedError(error) {
+	if (!(error instanceof Error)) return false;
+	if (isCodexAppServerIndeterminateTransportError(error)) return true;
+	return error.message === "codex app-server client is closed" || error.message.startsWith("codex app-server exited:");
 }
-/** Maps one prepared route to one mutually exclusive app-server auth handoff. */
-async function resolveCodexAppServerPreparedAuthHandoff(params) {
-	if (params.authRequirement === "api-key") {
-		const apiKey = params.resolvedApiKey?.trim();
-		if (!apiKey) throw new Error("Prepared Codex API-key route is missing its resolved API key.");
-		return {
-			nativeAuthProfile: false,
-			preparedAuth: {
-				kind: "api-key",
-				apiKey
-			}
+/** Stateful app-server JSON-RPC client over stdio or websocket transport. */
+var CodexAppServerClient = class CodexAppServerClient {
+	constructor(child) {
+		this.instanceId = randomUUID();
+		this.pending = /* @__PURE__ */ new Map();
+		this.requestHandlers = /* @__PURE__ */ new Set();
+		this.notificationHandlers = /* @__PURE__ */ new Set();
+		this.closeHandlers = /* @__PURE__ */ new Set();
+		this.nextId = 1;
+		this.initialized = false;
+		this.closed = false;
+		this.transportExited = false;
+		this.stderrTail = "";
+		this.child = child;
+		this.lines = createInterface({ input: child.stdout });
+		this.lines.on("line", (line) => this.handleLine(line));
+		this.lines.on("error", (error) => this.closeWithError(error instanceof Error ? error : new Error(String(error))));
+		child.stdout.on("error", (error) => this.closeWithError(error instanceof Error ? error : new Error(String(error))));
+		child.stderr.setEncoding("utf8");
+		child.stderr.on("data", (text) => {
+			this.stderrTail = appendBoundedTail(this.stderrTail, text, CODEX_APP_SERVER_STDERR_TAIL_MAX);
+			const trimmed = text.trim();
+			if (trimmed) embeddedAgentLog.debug(`codex app-server stderr: ${trimmed}`);
+		});
+		child.stderr.on("error", (error) => {
+			embeddedAgentLog.warn("codex app-server stderr stream failed", { error });
+		});
+		child.once("error", (error) => this.closeWithError(error instanceof Error ? error : new Error(String(error))));
+		child.once("exit", (code, signal) => {
+			this.transportExited = true;
+			this.closeWithError(buildCodexAppServerExitError(code, signal, this.stderrTail));
+		});
+		child.stdin.on?.("error", (error) => this.closeWithError(error instanceof Error ? error : new Error(String(error))));
+	}
+	/** Starts a new app-server client using resolved runtime start options. */
+	static start(options) {
+		const defaults = resolveCodexAppServerRuntimeOptions().start;
+		const startOptions = {
+			...defaults,
+			...options,
+			headers: options?.headers ?? defaults.headers
 		};
+		if (startOptions.transport === "stdio" && startOptions.commandSource === "managed") throw new Error("Managed Codex app-server start options must be resolved before spawn.");
+		if (startOptions.transport === "websocket" || startOptions.transport === "unix") return new CodexAppServerClient(createWebSocketTransport(startOptions));
+		return new CodexAppServerClient(createStdioTransport(startOptions));
 	}
-	const authProfileId = params.authProfileId?.trim() || void 0;
-	const nativeAuthProfile = isCodexAppServerNativeAuthProfile({
-		authProfileId,
-		authProfileStore: params.authProfileStore,
-		agentDir: params.agentDir,
-		config: params.config
-	});
-	if (params.authRequirement !== "subscription") return {
-		authProfileId,
-		nativeAuthProfile
-	};
-	if (!authProfileId || !nativeAuthProfile) throw createCodexAppServerAuthError(params.subscriptionProfileRequiredError);
-	const snapshot = await resolveCodexAppServerPreparedAuthProfileSnapshot({
-		authProfileId,
-		authProfileStore: params.authProfileStore,
-		agentDir: params.agentDir,
-		config: params.config
-	});
-	if (!snapshot) throw createCodexAppServerAuthError(params.subscriptionProfileUnusableError);
-	return {
-		authProfileId,
-		nativeAuthProfile,
-		preparedAuth: {
-			kind: "profile",
-			profileId: authProfileId,
-			store: params.authProfileStore,
-			snapshot
+	/** Builds a client around a fake transport for tests. */
+	static fromTransportForTests(child) {
+		return new CodexAppServerClient(child);
+	}
+	/** Performs the app-server initialize handshake and validates protocol version. */
+	async initialize() {
+		if (this.initialized) return;
+		const response = await this.request("initialize", {
+			clientInfo: {
+				name: "openclaw",
+				title: "OpenClaw",
+				version: OPENCLAW_VERSION
+			},
+			capabilities: { experimentalApi: true }
+		});
+		this.serverVersion = assertSupportedCodexAppServerVersion(response);
+		this.runtimeIdentity = buildCodexAppServerRuntimeIdentity(response, this.serverVersion);
+		this.notify("initialized");
+		this.initialized = true;
+	}
+	/** Returns the version detected during initialize. */
+	getServerVersion() {
+		return this.serverVersion;
+	}
+	/** Returns runtime metadata detected during initialize. */
+	getRuntimeIdentity() {
+		return this.runtimeIdentity ? { ...this.runtimeIdentity } : void 0;
+	}
+	/** Stable generation id for this exact physical client instance. */
+	getInstanceId() {
+		return this.instanceId;
+	}
+	/** Installs the spawn-owner check run before config-loading thread requests. */
+	setThreadSessionRequestGuard(guard) {
+		this.threadSessionRequestGuard = guard;
+	}
+	/** Returns the local transport PID for scoped child-process cleanup, when available. */
+	getTransportPid() {
+		return this.child.pid;
+	}
+	request(method, params, optionsInput) {
+		let options = optionsInput;
+		options ??= {};
+		if (this.closed) return Promise.reject(this.closeError ?? /* @__PURE__ */ new Error("codex app-server client is closed"));
+		if (options.signal?.aborted) return Promise.reject(new CodexAppServerLocalRequestCancellationError(method, "aborted", false));
+		const guard = method === "thread/start" || method === "thread/resume" || method === "thread/fork" ? this.threadSessionRequestGuard : void 0;
+		if (guard) {
+			if (!options.signal && !(options.timeoutMs !== void 0 && Number.isFinite(options.timeoutMs) && options.timeoutMs > 0)) return Promise.reject(/* @__PURE__ */ new TypeError(`${method} requires a positive finite timeout or abort signal`));
+			return (async () => {
+				const guardStartedAt = Date.now();
+				const timeoutMessage = `${method} timed out`;
+				const abortMessage = `${method} aborted`;
+				let releaseGuard;
+				try {
+					releaseGuard = await guard({
+						signal: options.signal,
+						timeoutMs: options.timeoutMs,
+						timeoutMessage,
+						abortMessage
+					});
+				} catch (error) {
+					if (error instanceof Error && error.message === timeoutMessage) throw new CodexAppServerLocalRequestCancellationError(method, "timed out", false);
+					if (error instanceof Error && error.message === abortMessage) throw new CodexAppServerLocalRequestCancellationError(method, "aborted", false);
+					throw error;
+				}
+				let released = false;
+				const release = () => {
+					if (released) return;
+					released = true;
+					releaseGuard();
+				};
+				let releaseWhenRequestSettles = true;
+				let requestMayHaveWritten = false;
+				try {
+					const elapsedMs = Date.now() - guardStartedAt;
+					const remainingTimeoutMs = options.timeoutMs === void 0 ? void 0 : options.timeoutMs - elapsedMs;
+					if (remainingTimeoutMs !== void 0 && remainingTimeoutMs <= 0) throw new CodexAppServerLocalRequestCancellationError(method, "timed out", false);
+					return await this.requestWithoutThreadSessionGuard(method, params, {
+						...options,
+						...remainingTimeoutMs !== void 0 ? { timeoutMs: remainingTimeoutMs } : {}
+					}, () => {
+						requestMayHaveWritten = true;
+					});
+				} catch (error) {
+					if (requestMayHaveWritten && !(error instanceof CodexAppServerRpcError)) {
+						releaseWhenRequestSettles = false;
+						await this.closeAndRunAfterExit(release, method);
+					}
+					throw error;
+				} finally {
+					if (releaseWhenRequestSettles) release();
+				}
+			})();
 		}
-	};
-}
-async function resolveCodexAppServerAuthAccountCacheKey(params) {
-	const agentDir = params.agentDir?.trim() || resolveDefaultAgentDir(params.config ?? {});
-	const store = resolveCodexAppServerAuthProfileStore({
-		agentDir,
-		authProfileId: params.authProfileId,
-		authProfileStore: params.authProfileStore,
-		config: params.config
-	});
-	const profileId = resolveCodexAppServerAuthProfileId({
-		authProfileId: params.authProfileId,
-		store,
-		config: params.config
-	});
-	if (!profileId) return;
-	const credential = store.profiles[profileId];
-	if (!credential || !isCodexAppServerAuthProfileCredential(credential, params.config)) return;
-	if (credential.type === "api_key") {
-		const apiKey = (await resolveApiKeyForProfile({
-			store,
-			profileId,
-			agentDir
-		}))?.apiKey?.trim();
-		return apiKey ? `${resolveChatgptAccountId(profileId, credential)}:${fingerprintApiKeyAuthProfileCacheKey(apiKey)}` : resolveChatgptAccountId(profileId, credential);
+		return this.requestWithoutThreadSessionGuard(method, params, options);
 	}
-	if (credential.type === "token") {
-		const accessToken = (await resolveApiKeyForProfile({
-			store,
-			profileId,
-			agentDir
-		}))?.apiKey?.trim();
-		return accessToken ? `${resolveChatgptAccountId(profileId, credential)}:${fingerprintTokenAuthProfileCacheKey(accessToken)}` : resolveChatgptAccountId(profileId, credential);
+	requestWithoutThreadSessionGuard(method, params, options, onWriteAttempt) {
+		return this.requestWithOverloadRetry(method, params, options, onWriteAttempt);
 	}
-	return resolveChatgptAccountId(profileId, credential);
-}
-function resolveCodexAppServerEnvApiKeyCacheKey(params) {
-	if (params.startOptions.transport !== "stdio") return;
-	const apiKey = readFirstNonEmptyEnvEntry(resolveCodexAppServerSpawnEnv(params.startOptions, params.baseEnv ?? process.env, params.platform ?? process.platform), CODEX_APP_SERVER_API_KEY_ENV_VARS);
-	if (!apiKey) return;
-	const hash = createHash("sha256");
-	hash.update("openclaw:codex:app-server-env-api-key:v1");
-	hash.update("\0");
-	hash.update(apiKey.key);
-	hash.update("\0");
-	hash.update(apiKey.value);
-	return `${apiKey.key}:sha256:${hash.digest("hex")}`;
-}
-function resolveCodexAppServerFallbackApiKeyCacheKey(params) {
-	if (params.startOptions.transport !== "stdio") return;
-	return resolveCodexAppServerEnvApiKeyCacheKey(params) ?? resolveCodexCliAuthFileApiKeyCacheKey(params.baseEnv ?? process.env);
-}
-/** Secret-free cache identity for an API key already resolved by the runtime plan. */
-function resolveCodexAppServerPreparedApiKeyCacheKey(apiKey) {
-	const resolved = apiKey?.trim();
-	return resolved ? fingerprintApiKeyAuthProfileCacheKey(resolved) : void 0;
-}
-function fingerprintApiKeyAuthProfileCacheKey(apiKey) {
-	const hash = createHash("sha256");
-	hash.update("openclaw:codex:app-server-auth-profile-api-key:v1");
-	hash.update("\0");
-	hash.update(apiKey);
-	return `api_key:sha256:${hash.digest("hex")}`;
-}
-function fingerprintTokenAuthProfileCacheKey(accessToken) {
-	const hash = createHash("sha256");
-	hash.update("openclaw:codex:app-server-auth-profile-token:v1");
-	hash.update("\0");
-	hash.update(accessToken);
-	return `token:sha256:${hash.digest("hex")}`;
-}
-function fingerprintCodexCliAuthFileApiKeyCacheKey(apiKey) {
-	const hash = createHash("sha256");
-	hash.update("openclaw:codex:app-server-cli-auth-json-api-key:v1");
-	hash.update("\0");
-	hash.update(apiKey);
-	return `CODEX_AUTH_JSON:sha256:${hash.digest("hex")}`;
-}
-async function withCodexHomeEnvironment(startOptions, agentDir, pluginConfig) {
-	const codexHome = startOptions.env?.[CODEX_HOME_ENV_VAR]?.trim() ? startOptions.env[CODEX_HOME_ENV_VAR] : startOptions.homeScope === "user" ? resolveCodexAppServerUserHomeDir(process.env) : resolveCodexAppServerHomeDir(agentDir);
-	const nativeHome = startOptions.env?.[HOME_ENV_VAR]?.trim() ? startOptions.env[HOME_ENV_VAR] : void 0;
-	await fs.mkdir(codexHome, { recursive: true });
-	await ensureCodexComputerUseSharedPluginCache({
-		codexHome,
-		config: resolveCodexComputerUseConfig({ pluginConfig })
-	});
-	if (nativeHome) await fs.mkdir(nativeHome, { recursive: true });
-	const nextStartOptions = {
-		...startOptions,
-		env: {
-			...startOptions.env,
-			[CODEX_HOME_ENV_VAR]: codexHome,
-			...nativeHome ? { [HOME_ENV_VAR]: nativeHome } : {}
+	async requestWithOverloadRetry(method, params, options, onWriteAttempt) {
+		const deadline = options.timeoutMs !== void 0 && Number.isFinite(options.timeoutMs) ? Date.now() + options.timeoutMs : void 0;
+		for (let retry = 0;; retry += 1) {
+			if (options.signal?.aborted) throw new CodexAppServerLocalRequestCancellationError(method, "aborted", false);
+			const remainingTimeoutMs = deadline === void 0 ? void 0 : deadline - Date.now();
+			if (remainingTimeoutMs !== void 0 && remainingTimeoutMs <= 0) throw new CodexAppServerLocalRequestCancellationError(method, "timed out", false);
+			try {
+				return await this.requestOnce(method, params, {
+					...options,
+					...remainingTimeoutMs !== void 0 ? { timeoutMs: remainingTimeoutMs } : {}
+				}, onWriteAttempt);
+			} catch (error) {
+				if (!(error instanceof CodexAppServerRpcError) || error.code !== CODEX_APP_SERVER_OVERLOADED_ERROR_CODE || retry >= CODEX_APP_SERVER_OVERLOAD_MAX_RETRIES) throw error;
+				const backoffMs = Math.round(CODEX_APP_SERVER_OVERLOAD_RETRY_BASE_MS * 2 ** retry * (.75 + Math.random() * .5));
+				await this.waitForOverloadRetry(method, backoffMs, deadline, options.signal);
+			}
 		}
-	};
-	const clearEnv = withoutClearedCodexHomeEnv(startOptions.clearEnv);
-	if (clearEnv) nextStartOptions.clearEnv = clearEnv;
-	else delete nextStartOptions.clearEnv;
-	return nextStartOptions;
-}
-function withoutClearedCodexHomeEnv(clearEnv) {
-	if (!clearEnv) return;
-	const reserved = new Set(CODEX_APP_SERVER_HOME_ENV_VARS);
-	const filtered = clearEnv.filter((envVar) => !reserved.has(envVar.trim().toUpperCase()));
-	return filtered.length === clearEnv.length ? clearEnv : filtered;
-}
-async function applyCodexAppServerAuthProfile(params) {
-	if (params.preparedAuth?.kind === "profile") {
-		await params.client.request("account/login/start", params.preparedAuth.snapshot.loginParams);
-		return;
 	}
-	if (params.preparedAuth?.kind === "api-key") {
-		await params.client.request("account/login/start", {
-			type: "apiKey",
-			apiKey: params.preparedAuth.apiKey
+	async waitForOverloadRetry(method, backoffMs, deadline, signal) {
+		if (signal?.aborted) throw new CodexAppServerLocalRequestCancellationError(method, "aborted", false);
+		const remainingMs = deadline === void 0 ? void 0 : deadline - Date.now();
+		if (remainingMs !== void 0 && remainingMs <= 0) throw new CodexAppServerLocalRequestCancellationError(method, "timed out", false);
+		const delayMs = remainingMs === void 0 ? backoffMs : Math.min(backoffMs, remainingMs);
+		await new Promise((resolve, reject) => {
+			const timer = setTimeout(() => {
+				cleanup();
+				resolve();
+			}, delayMs);
+			timer.unref?.();
+			const abortListener = () => {
+				cleanup();
+				reject(new CodexAppServerLocalRequestCancellationError(method, "aborted", false));
+			};
+			const cleanup = () => {
+				clearTimeout(timer);
+				signal?.removeEventListener("abort", abortListener);
+			};
+			signal?.addEventListener("abort", abortListener, { once: true });
+			if (signal?.aborted) abortListener();
+		});
+	}
+	requestOnce(method, params, options, onWriteAttempt) {
+		if (this.closed) return Promise.reject(this.closeError ?? /* @__PURE__ */ new Error("codex app-server client is closed"));
+		if (options.signal?.aborted) return Promise.reject(new CodexAppServerLocalRequestCancellationError(method, "aborted", false));
+		const id = this.nextId++;
+		const message = {
+			id,
+			method,
+			params
+		};
+		return new Promise((resolve, reject) => {
+			let timeout;
+			let cleanupAbort;
+			let mayHaveWritten = false;
+			const cleanup = () => {
+				if (timeout) {
+					clearTimeout(timeout);
+					timeout = void 0;
+				}
+				cleanupAbort?.();
+				cleanupAbort = void 0;
+			};
+			const rejectPending = (error) => {
+				if (!this.pending.has(id)) return;
+				this.pending.delete(id);
+				cleanup();
+				reject(mayHaveWritten && !(error instanceof CodexAppServerRpcError) && !isCodexAppServerIndeterminateRequestCancellationError(error) && !isCodexAppServerIndeterminateTransportError(error) ? new CodexAppServerIndeterminateTransportError(method, error) : error);
+			};
+			if (options.timeoutMs && Number.isFinite(options.timeoutMs) && options.timeoutMs > 0) {
+				timeout = setTimeout(() => rejectPending(new CodexAppServerLocalRequestCancellationError(method, "timed out", mayHaveWritten)), Math.max(100, options.timeoutMs));
+				timeout.unref?.();
+			}
+			if (options.signal) {
+				const abortListener = () => rejectPending(new CodexAppServerLocalRequestCancellationError(method, "aborted", mayHaveWritten));
+				options.signal.addEventListener("abort", abortListener, { once: true });
+				cleanupAbort = () => options.signal?.removeEventListener("abort", abortListener);
+			}
+			this.pending.set(id, {
+				method,
+				resolve: (value) => {
+					cleanup();
+					resolve(value);
+				},
+				reject: (error) => {
+					cleanup();
+					reject(mayHaveWritten && !(error instanceof CodexAppServerRpcError) && !isCodexAppServerIndeterminateRequestCancellationError(error) && !isCodexAppServerIndeterminateTransportError(error) ? new CodexAppServerIndeterminateTransportError(method, error) : error);
+				},
+				cleanup
+			});
+			if (options.signal?.aborted) {
+				rejectPending(new CodexAppServerLocalRequestCancellationError(method, "aborted", false));
+				return;
+			}
+			try {
+				mayHaveWritten = true;
+				onWriteAttempt?.();
+				this.writeMessage(message, (error) => rejectPending(error));
+			} catch (error) {
+				rejectPending(error instanceof Error ? error : new Error(String(error)));
+			}
+		});
+	}
+	/** Sends a fire-and-forget JSON-RPC notification to the app-server. */
+	notify(method, params) {
+		this.writeMessage({
+			method,
+			params
 		});
-		return;
 	}
-	if (params.authProfileId === null) {
-		if (params.authRequirement === "subscription") {
-			const response = await params.client.request("account/read", { refreshToken: false });
-			if (!isJsonObject$1(response.account) || response.account.type !== "chatgpt") throw createCodexAppServerAuthError("Codex subscription auth profile could not produce login credentials.");
+	/** Registers a handler for app-server requests sent back to OpenClaw. */
+	addRequestHandler(handler) {
+		this.requestHandlers.add(handler);
+		return () => this.requestHandlers.delete(handler);
+	}
+	/** Registers a notification handler and returns its disposer. */
+	addNotificationHandler(handler) {
+		this.notificationHandlers.add(handler);
+		return () => this.notificationHandlers.delete(handler);
+	}
+	/** Registers a close handler and returns its disposer. */
+	addCloseHandler(handler) {
+		this.closeHandlers.add(handler);
+		return () => this.closeHandlers.delete(handler);
+	}
+	/** Closes the transport without waiting for process/socket shutdown. */
+	close() {
+		if (!this.markClosed(/* @__PURE__ */ new Error("codex app-server client is closed"))) return;
+		closeCodexAppServerTransport(this.child);
+	}
+	/** Closes the transport and waits for shutdown according to transport policy. */
+	async closeAndWait(options) {
+		this.markClosed(/* @__PURE__ */ new Error("codex app-server client is closed"));
+		return await closeCodexAppServerTransportAndWait(this.child, options);
+	}
+	/** Closes this transport and runs cleanup only after physical process exit. */
+	async closeAndRunAfterExit(onExit, operation) {
+		let settled = false;
+		const runOnExit = () => {
+			if (settled) return;
+			settled = true;
+			onExit();
+		};
+		if (this.transportExited) {
+			runOnExit();
+			return;
+		}
+		this.child.once("exit", runOnExit);
+		try {
+			if (await this.closeAndWait()) {
+				this.child.off?.("exit", runOnExit);
+				runOnExit();
+			}
+		} catch (closeError) {
+			embeddedAgentLog.warn("codex app-server shutdown after indeterminate request failed", {
+				closeError,
+				operation
+			});
 		}
-		return;
 	}
-	let loginParams;
-	try {
-		loginParams = await resolveCodexAppServerAuthProfileLoginParams({
-			agentDir: params.agentDir,
-			authProfileId: params.authProfileId,
-			authProfileStore: params.authProfileStore,
-			config: params.config
+	writeMessage(message, onError) {
+		if (this.closed) return;
+		const id = "id" in message ? message.id : void 0;
+		const method = "method" in message ? message.method : void 0;
+		this.child.stdin.write(`${stringifyCodexAppServerMessage(message)}\n`, (error) => {
+			if (error) {
+				embeddedAgentLog.warn("codex app-server write failed", {
+					error,
+					id,
+					method
+				});
+				onError?.(error);
+			}
 		});
-	} catch (error) {
-		if (params.authRequirement === "subscription" && error instanceof CodexAppServerAuthProfileUnavailableError) throw createCodexAppServerAuthError("Codex subscription auth profile could not produce login credentials.", error);
-		throw error;
 	}
-	if (params.authRequirement === "subscription" && loginParams?.type !== "chatgptAuthTokens") throw createCodexAppServerAuthError("Codex subscription auth profile could not produce login credentials.");
-	if (!loginParams) {
-		if (params.authRequirement === "subscription") throw createCodexAppServerAuthError("Codex subscription auth profile could not produce login credentials.");
-		if (params.authRequirement !== "api-key" || params.startOptions?.transport !== "stdio") return;
-		const env = resolveCodexAppServerSpawnEnv(params.startOptions, process.env);
-		const fallbackLoginParams = await resolveCodexAppServerFallbackApiKeyLoginParams({
-			client: params.client,
-			env,
-			codexCliAuthEnv: process.env
-		});
-		if (fallbackLoginParams) await params.client.request("account/login/start", fallbackLoginParams);
-		return;
+	handleLine(line) {
+		const rawLine = line.endsWith("\r") ? line.slice(0, -1) : line;
+		if (this.pendingParse) {
+			this.handlePendingParseLine(rawLine);
+			return;
+		}
+		const trimmed = rawLine.trim();
+		if (!trimmed) return;
+		let parsed;
+		try {
+			parsed = JSON.parse(trimmed);
+		} catch (error) {
+			if (shouldBufferCodexAppServerParseFailure(trimmed, error)) {
+				this.pendingParse = {
+					text: trimmed,
+					lineCount: 1,
+					firstError: error
+				};
+				return;
+			}
+			logCodexAppServerParseFailure(trimmed, error, 1);
+			return;
+		}
+		this.handleParsedMessage(parsed);
 	}
-	await params.client.request("account/login/start", loginParams);
-}
-function createCodexAppServerAuthError(message, cause) {
-	const error = cause === void 0 ? new Error(message) : new Error(message, { cause });
-	return Object.assign(error, { status: 401 });
-}
-var CodexAppServerAuthProfileUnavailableError = class extends Error {};
-async function resolveCodexAppServerAuthProfileLoginParams(params) {
-	const store = resolveCodexAppServerAuthProfileStore(params);
-	const profileId = resolveCodexAppServerAuthProfileId({
-		authProfileId: params.authProfileId,
-		store,
-		config: params.config
-	});
-	const profile = profileId ? store.profiles[profileId] : void 0;
-	if (profileId && !profile) throw new CodexAppServerAuthProfileUnavailableError(`Codex app-server auth profile "${profileId}" was not found.`);
-	if (profileId && profile && !isCodexAppServerAuthProfileCredential(profile, params.config)) throw new CodexAppServerAuthProfileUnavailableError(`Codex app-server auth profile "${profileId}" must be OpenAI Codex auth or an OpenAI API-key backup.`);
-	return await resolveCodexAppServerAuthProfileLoginParamsInternal({
-		...params,
-		authProfileStore: store
-	});
-}
-async function refreshCodexAppServerAuthTokens(params) {
-	const loginParams = await resolveCodexAppServerAuthProfileLoginParamsInternal({
-		...params,
-		forceOAuthRefresh: true
-	});
-	if (!loginParams || loginParams.type !== "chatgptAuthTokens") throw new Error("Codex app-server ChatGPT token refresh requires an OAuth auth profile.");
-	return {
-		accessToken: loginParams.accessToken,
-		chatgptAccountId: loginParams.chatgptAccountId,
-		chatgptPlanType: loginParams.chatgptPlanType ?? null
-	};
-}
-async function resolveCodexAppServerAuthProfileLoginParamsInternal(params) {
-	const store = resolveCodexAppServerAuthProfileStore({
-		agentDir: params.agentDir,
-		authProfileId: params.authProfileId,
-		authProfileStore: params.authProfileStore,
-		config: params.config
-	});
-	const profileId = resolveCodexAppServerAuthProfileId({
-		authProfileId: params.authProfileId,
-		store,
-		config: params.config
-	});
-	if (!profileId) return;
-	const credential = store.profiles[profileId];
-	if (!credential) throw new Error(`Codex app-server auth profile "${profileId}" was not found.`);
-	if (!isCodexAppServerAuthProfileCredential(credential, params.config)) throw new Error(`Codex app-server auth profile "${profileId}" must be OpenAI Codex auth or an OpenAI API-key backup.`);
-	const loginParams = await resolveLoginParamsForCredential(profileId, credential, {
-		agentDir: params.agentDir,
-		store,
-		preferStoreCredential: Boolean(params.authProfileStore?.profiles[profileId]),
-		forceOAuthRefresh: params.forceOAuthRefresh === true,
-		config: params.config
-	});
-	if (!loginParams) throw new CodexAppServerAuthProfileUnavailableError(`Codex app-server auth profile "${profileId}" does not contain usable credentials.`);
-	return loginParams;
-}
-async function resolveCodexAppServerFallbackApiKeyLoginParams(params) {
-	const apiKey = readFirstNonEmptyEnv(params.env, CODEX_APP_SERVER_API_KEY_ENV_VARS) ?? await readCodexCliAuthFileApiKey(params.codexCliAuthEnv);
-	if (!apiKey) return;
-	if ((await params.client.request("account/read", { refreshToken: false })).account) return;
-	return {
-		type: "apiKey",
-		apiKey
-	};
-}
-function resolveCodexCliAuthFilePath(env) {
-	const configuredCodexHome = env[CODEX_HOME_ENV_VAR]?.trim();
-	if (configuredCodexHome) return path.join(resolveHomeRelativePath(configuredCodexHome, env), CODEX_AUTH_JSON_FILENAME);
-	const home = env[HOME_ENV_VAR]?.trim() || env.USERPROFILE?.trim() || os.homedir();
-	return path.join(home, CODEX_HOME_DIRNAME, CODEX_AUTH_JSON_FILENAME);
-}
-function resolveHomeRelativePath(value, env) {
-	if (value === "~" || value.startsWith("~/") || value.startsWith("~\\")) {
-		const home = env[HOME_ENV_VAR]?.trim() || env.USERPROFILE?.trim() || os.homedir();
-		return path.join(home, value.slice(value === "~" ? 1 : 2));
+	handlePendingParseLine(line) {
+		const pending = this.pendingParse;
+		if (!pending) return;
+		const candidate = `${pending.text}\\n${line}`;
+		let parsed;
+		try {
+			parsed = JSON.parse(candidate);
+		} catch (error) {
+			const lineCount = pending.lineCount + 1;
+			if (shouldBufferCodexAppServerParseFailure(candidate.trim(), error) && candidate.length <= CODEX_APP_SERVER_PARSE_BUFFER_MAX && lineCount <= CODEX_APP_SERVER_PARSE_BUFFER_MAX_LINES) {
+				this.pendingParse = {
+					text: candidate,
+					lineCount,
+					firstError: pending.firstError
+				};
+				return;
+			}
+			this.pendingParse = void 0;
+			logCodexAppServerParseFailure(candidate, error, lineCount);
+			return;
+		}
+		this.pendingParse = void 0;
+		this.handleParsedMessage(parsed);
 	}
-	return value;
-}
-function parseCodexCliAuthFileApiKey(raw) {
-	let parsed;
-	try {
-		parsed = JSON.parse(raw);
-	} catch {
-		return;
+	handleParsedMessage(parsed) {
+		if (!parsed || typeof parsed !== "object") return;
+		const message = parsed;
+		if (isRpcResponse(message)) {
+			this.handleResponse(message);
+			return;
+		}
+		if (!("method" in message)) return;
+		if ("id" in message && message.id !== void 0) {
+			this.handleServerRequest({
+				id: message.id,
+				method: message.method,
+				params: message.params
+			});
+			return;
+		}
+		this.handleNotification({
+			method: message.method,
+			params: message.params
+		});
 	}
-	if (!parsed || typeof parsed !== "object") return;
-	const apiKey = parsed.OPENAI_API_KEY;
-	return typeof apiKey === "string" && apiKey.trim() ? apiKey.trim() : void 0;
-}
-async function readCodexCliAuthFileApiKey(env) {
-	try {
-		return parseCodexCliAuthFileApiKey(await fs.readFile(resolveCodexCliAuthFilePath(env), "utf8"));
-	} catch {
-		return;
+	handleResponse(response) {
+		const pending = this.pending.get(response.id);
+		if (!pending) return;
+		this.pending.delete(response.id);
+		if (response.error) {
+			pending.reject(new CodexAppServerRpcError(response.error, pending.method));
+			return;
+		}
+		pending.resolve(response.result);
 	}
-}
-function resolveCodexCliAuthFileApiKeyCacheKey(env) {
-	try {
-		const apiKey = parseCodexCliAuthFileApiKey(fsSync.readFileSync(resolveCodexCliAuthFilePath(env), "utf8"));
-		return apiKey ? fingerprintCodexCliAuthFileApiKeyCacheKey(apiKey) : void 0;
-	} catch {
-		return;
+	async handleServerRequest(request) {
+		try {
+			const result = await this.runServerRequestHandlers(request);
+			if (result !== void 0) {
+				this.writeMessage({
+					id: request.id,
+					result
+				});
+				return;
+			}
+			this.writeMessage({
+				id: request.id,
+				result: defaultServerRequestResponse(request)
+			});
+		} catch (error) {
+			const message = error instanceof Error ? error.message : String(error);
+			embeddedAgentLog.warn("codex app-server server request handler failed", {
+				id: request.id,
+				method: request.method,
+				error
+			});
+			this.writeMessage({
+				id: request.id,
+				error: {
+					code: -32603,
+					message
+				}
+			});
+		}
 	}
-}
-async function resolveLoginParamsForCredential(profileId, credential, params) {
-	if (credential.type === "api_key") {
-		const apiKey = (await resolveApiKeyForProfile({
-			store: params.preferStoreCredential ? params.store : ensureAuthProfileStore(params.agentDir, { allowKeychainPrompt: false }),
-			profileId,
-			agentDir: params.agentDir
-		}))?.apiKey?.trim();
-		return apiKey ? {
-			type: "apiKey",
-			apiKey
-		} : void 0;
+	async runServerRequestHandlers(request) {
+		const controller = new AbortController();
+		const timeoutResponse = timeoutServerRequestResponse(request);
+		if (!timeoutResponse) return await this.runServerRequestHandlersWithoutTimeout(request, controller.signal);
+		let timeout;
+		try {
+			return await Promise.race([this.runServerRequestHandlersWithoutTimeout(request, controller.signal), new Promise((resolve) => {
+				timeout = setTimeout(() => {
+					embeddedAgentLog.warn("codex app-server server request timed out", {
+						id: request.id,
+						method: request.method,
+						timeoutMs: CODEX_DYNAMIC_TOOL_SERVER_REQUEST_TIMEOUT_MS
+					});
+					controller.abort(/* @__PURE__ */ new Error("codex app-server server request timed out"));
+					resolve(timeoutResponse);
+				}, CODEX_DYNAMIC_TOOL_SERVER_REQUEST_TIMEOUT_MS);
+				timeout.unref?.();
+			})]);
+		} finally {
+			if (timeout) clearTimeout(timeout);
+		}
 	}
-	if (credential.type === "token") {
-		const accessToken = (await resolveApiKeyForProfile({
-			store: params.preferStoreCredential ? params.store : ensureAuthProfileStore(params.agentDir, { allowKeychainPrompt: false }),
-			profileId,
-			agentDir: params.agentDir
-		}))?.apiKey?.trim();
-		return accessToken ? buildChatgptAuthTokensParams(profileId, credential, accessToken) : void 0;
+	async runServerRequestHandlersWithoutTimeout(request, signal) {
+		for (const handler of this.requestHandlers) {
+			if (signal.aborted) return;
+			const result = await handler(request, signal);
+			if (result !== void 0) return result;
+		}
 	}
-	if (credential.type !== "oauth") return;
-	const resolvedCredential = await resolveOAuthCredentialForCodexAppServer(profileId, credential, {
-		agentDir: params.agentDir,
-		store: params.store,
-		preferStoreCredential: params.preferStoreCredential,
-		forceRefresh: params.forceOAuthRefresh,
-		config: params.config
-	});
-	const accessToken = resolvedCredential.access?.trim();
-	return accessToken ? buildChatgptAuthTokensParams(profileId, resolvedCredential, accessToken) : void 0;
-}
-async function resolveOAuthCredentialForCodexAppServer(profileId, credential, params) {
-	const ownerAgentDir = resolvePersistedAuthProfileOwnerAgentDir({
-		agentDir: params.agentDir,
-		profileId
-	});
-	const persistedCredential = findPersistedAuthProfileCredential({
-		agentDir: ownerAgentDir,
-		profileId
-	});
-	const useScopedCredential = params.preferStoreCredential && shouldUseScopedOAuthCredential({
-		store: params.store,
-		profileId,
-		persistedCredential,
-		suppliedCredential: credential,
-		config: params.config
-	});
-	const store = useScopedCredential ? params.store : ensureCodexAppServerAuthProfileStore({
-		agentDir: ownerAgentDir,
-		authProfileId: profileId,
-		config: params.config
-	});
-	const persistedOAuthCredential = !useScopedCredential && persistedCredential?.type === "oauth" && isCodexAppServerAuthProvider(persistedCredential.provider, params.config) ? persistedCredential : void 0;
-	const ownerCredential = store.profiles[profileId];
-	const overlaidOAuthCredential = ownerCredential?.type === "oauth" && isCodexAppServerAuthProvider(ownerCredential.provider, params.config) ? ownerCredential : void 0;
-	if (useScopedCredential && overlaidOAuthCredential) return await resolveScopedOAuthCredential({
-		store,
-		profileId,
-		credential: overlaidOAuthCredential,
-		forceRefresh: params.forceRefresh
-	});
-	if (params.forceRefresh && !persistedOAuthCredential && overlaidOAuthCredential) {
-		const refreshedRuntimeCredential = await refreshOAuthCredentialForRuntime({ credential: overlaidOAuthCredential });
-		if (!refreshedRuntimeCredential?.access?.trim()) throw new Error(`Codex app-server auth profile "${profileId}" could not refresh.`);
-		store.profiles[profileId] = refreshedRuntimeCredential;
-		return refreshedRuntimeCredential;
+	handleNotification(notification) {
+		for (const handler of this.notificationHandlers) Promise.resolve(handler(notification)).catch((error) => {
+			embeddedAgentLog.warn("codex app-server notification handler failed", { error });
+		});
 	}
-	const resolved = await resolveApiKeyForProfile({
-		store,
-		profileId,
-		agentDir: ownerAgentDir,
-		forceRefresh: params.forceRefresh && Boolean(persistedOAuthCredential)
-	});
-	const refreshed = useScopedCredential ? void 0 : loadAuthProfileStoreForSecretsRuntime(ownerAgentDir).profiles[profileId];
-	const refreshedOAuthCredential = refreshed?.type === "oauth" && isCodexAppServerAuthProvider(refreshed.provider, params.config) ? refreshed : void 0;
-	if (refreshedOAuthCredential && isDeepStrictEqual(params.store.profiles[profileId], credential)) params.store.profiles[profileId] = refreshedOAuthCredential;
-	const storedCredential = store.profiles[profileId];
-	const candidate = refreshedOAuthCredential ? refreshedOAuthCredential : storedCredential?.type === "oauth" && isCodexAppServerAuthProvider(storedCredential.provider, params.config) ? storedCredential : credential;
-	return resolved?.apiKey ? {
-		...candidate,
-		access: resolved.apiKey
-	} : candidate;
-}
-function shouldUseScopedOAuthCredential(params) {
-	if (!params.store.runtimePersistedProfileIds?.includes(params.profileId)) return true;
-	const persisted = params.persistedCredential;
-	if (persisted?.type !== "oauth") return true;
-	if (resolveProviderIdForAuth(persisted.provider, { config: params.config }) !== resolveProviderIdForAuth(params.suppliedCredential.provider, { config: params.config })) return true;
-	return !isDeepStrictEqual(persisted, params.suppliedCredential) && !hasMatchingOAuthIdentity(persisted, params.suppliedCredential);
-}
-function hasMatchingOAuthIdentity(persisted, supplied) {
-	const persistedAccountId = persisted.accountId?.trim();
-	const suppliedAccountId = supplied.accountId?.trim();
-	if (persistedAccountId && suppliedAccountId) return persistedAccountId === suppliedAccountId;
-	const persistedEmail = persisted.email?.trim().toLowerCase();
-	const suppliedEmail = supplied.email?.trim().toLowerCase();
-	return Boolean(persistedEmail && suppliedEmail && persistedEmail === suppliedEmail);
-}
-async function resolveScopedOAuthCredential(params) {
-	const existingRefresh = scopedOAuthRefreshQueues.get(params.store)?.get(params.profileId);
-	if (existingRefresh) return await existingRefresh;
-	if (!params.forceRefresh && hasUsableOAuthCredential(params.credential)) return params.credential;
-	const storeRefreshes = scopedOAuthRefreshQueues.get(params.store) ?? /* @__PURE__ */ new Map();
-	scopedOAuthRefreshQueues.set(params.store, storeRefreshes);
-	const refresh = (async () => {
-		const current = params.store.profiles[params.profileId];
-		const credential = current?.type === "oauth" ? current : params.credential;
-		if (!params.forceRefresh && hasUsableOAuthCredential(credential)) return credential;
-		const refreshed = await refreshOAuthCredentialForRuntime({ credential });
-		if (!refreshed?.access?.trim()) throw new Error(`Codex app-server auth profile "${params.profileId}" could not refresh.`);
-		if (!isDeepStrictEqual(params.store.profiles[params.profileId], credential)) throw new Error(`Codex app-server auth profile "${params.profileId}" changed while refreshing.`);
-		params.store.profiles[params.profileId] = refreshed;
-		return refreshed;
-	})();
-	storeRefreshes.set(params.profileId, refresh);
-	try {
-		return await refresh;
-	} finally {
-		if (storeRefreshes.get(params.profileId) === refresh) storeRefreshes.delete(params.profileId);
+	closeWithError(error) {
+		if (this.markClosed(error)) closeCodexAppServerTransport(this.child);
 	}
+	markClosed(error) {
+		if (this.closed) return false;
+		this.closed = true;
+		this.closeError = error;
+		this.lines.close();
+		this.rejectPendingRequests(error);
+		return true;
+	}
+	rejectPendingRequests(error) {
+		for (const pending of this.pending.values()) {
+			pending.cleanup();
+			pending.reject(error);
+		}
+		this.pending.clear();
+		for (const handler of this.closeHandlers) handler(this);
+	}
+};
+function defaultServerRequestResponse(request) {
+	if (request.method === "item/tool/call") return {
+		contentItems: [{
+			type: "inputText",
+			text: "OpenClaw did not register a handler for this app-server tool call."
+		}],
+		success: false
+	};
+	if (request.method === "item/commandExecution/requestApproval" || request.method === "item/fileChange/requestApproval") return { decision: "decline" };
+	if (request.method === "item/permissions/requestApproval") return {
+		permissions: {},
+		scope: "turn"
+	};
+	if (request.method === "item/tool/requestUserInput") return { answers: {} };
+	if (request.method === "mcpServer/elicitation/request") return { action: "decline" };
+	return {};
 }
-function isCodexAppServerAuthProvider(provider, config) {
-	const resolvedProvider = resolveProviderIdForAuth(provider, { config });
-	return resolvedProvider === CODEX_APP_SERVER_AUTH_PROVIDER || resolvedProvider === OPENAI_CODEX_APP_SERVER_AUTH_PROVIDER || resolvedProvider === LEGACY_CODEX_APP_SERVER_AUTH_PROVIDER;
-}
-function isOpenAIApiKeyBackupCredential(credential, config) {
-	return credential.type === "api_key" && resolveProviderIdForAuth(credential.provider, { config }) === OPENAI_PROVIDER;
-}
-function isCodexAppServerAuthProfileCredential(credential, config) {
-	return isCodexAppServerAuthProvider(credential.provider, config) || isOpenAIApiKeyBackupCredential(credential, config);
-}
-function shouldClearOpenAiApiKeyForCodexAuthProfile(params) {
-	const profileId = params.authProfileId?.trim();
-	return isCodexSubscriptionCredential(profileId ? params.store.profiles[profileId] : params.store.profiles[OPENAI_CODEX_DEFAULT_PROFILE_ID], params.config);
-}
-function isCodexSubscriptionCredential(credential, config) {
-	if (!credential || !isCodexAppServerAuthProvider(credential.provider, config)) return false;
-	return credential.type === "oauth" || credential.type === "token";
+function stringifyCodexAppServerMessage(message) {
+	return JSON.stringify(message, (_key, value) => typeof value === "string" ? value.replace(UNPAIRED_SURROGATE_RE, "") : value) ?? "null";
 }
-function withClearedEnvironmentVariables(startOptions, envVars) {
-	const clearEnv = startOptions.clearEnv ?? [];
-	const missingEnvVars = envVars.filter((envVar) => !clearEnv.includes(envVar));
-	if (missingEnvVars.length === 0) return startOptions;
+function timeoutServerRequestResponse(request) {
+	if (request.method !== "item/tool/call") return;
 	return {
-		...startOptions,
-		clearEnv: [...clearEnv, ...missingEnvVars]
+		contentItems: [{
+			type: "inputText",
+			text: `OpenClaw dynamic tool call timed out after ${CODEX_DYNAMIC_TOOL_SERVER_REQUEST_TIMEOUT_MS}ms before sending a response to Codex.`
+		}],
+		success: false
 	};
 }
-function readFirstNonEmptyEnv(env, keys) {
-	return readFirstNonEmptyEnvEntry(env, keys)?.value;
-}
-function readFirstNonEmptyEnvEntry(env, keys) {
-	for (const key of keys) {
-		const value = env[key]?.trim();
-		if (value) return {
-			key,
-			value
-		};
+/** Raised when the initialize handshake detects an unsupported app-server version. */
+var CodexAppServerVersionError = class extends Error {
+	constructor(detectedVersion) {
+		const detected = detectedVersion ? `detected ${detectedVersion}` : "OpenClaw could not determine the running Codex version";
+		super(`A stable Codex app-server from ${MIN_CODEX_APP_SERVER_VERSION} through ${MAX_CODEX_APP_SERVER_VERSION} is required, but ${detected}. Update the configured Codex app-server binary, or remove custom command overrides to use the managed binary.`);
+		this.name = "CodexAppServerVersionError";
+		this.detectedVersion = detectedVersion;
 	}
+};
+function assertSupportedCodexAppServerVersion(response) {
+	const detectedVersion = readCodexVersionFromUserAgent(response.userAgent);
+	const parsedVersion = parse(detectedVersion ?? "");
+	if (!detectedVersion || !parsedVersion || parsedVersion.compare("0.143.0") < 0 || parsedVersion.compare("0.145.0") > 0 || parsedVersion.prerelease.length > 0 || parsedVersion.build.length > 0) throw new CodexAppServerVersionError(detectedVersion);
+	return detectedVersion;
 }
-function buildChatgptAuthTokensParams(profileId, credential, accessToken) {
+function isUnsupportedCodexAppServerVersionError(error) {
+	return error instanceof CodexAppServerVersionError;
+}
+function buildCodexAppServerRuntimeIdentity(response, serverVersion) {
+	const userAgent = readNonEmptyInitializeString(response.userAgent);
+	const codexHome = readNonEmptyInitializeString(response.codexHome);
+	const platformFamily = readNonEmptyInitializeString(response.platformFamily);
+	const platformOs = readNonEmptyInitializeString(response.platformOs);
 	return {
-		type: "chatgptAuthTokens",
-		accessToken,
-		chatgptAccountId: resolveChatgptAccountId(profileId, credential),
-		chatgptPlanType: resolveChatgptPlanType(credential)
+		serverVersion,
+		...userAgent ? { userAgent } : {},
+		...codexHome ? { codexHome } : {},
+		...platformFamily ? { platformFamily } : {},
+		...platformOs ? { platformOs } : {}
 	};
 }
-function resolveChatgptPlanType(credential) {
-	const record = credential;
-	const planType = record.chatgptPlanType ?? record.planType;
-	return typeof planType === "string" && planType.trim() ? planType.trim() : null;
-}
-function resolveChatgptAccountId(profileId, credential) {
-	return resolveStableChatgptAccountId(credential) ?? profileId;
-}
-function resolveStableChatgptAccountId(credential) {
-	if ("accountId" in credential && typeof credential.accountId === "string") {
-		const accountId = credential.accountId.trim();
-		if (accountId) return accountId;
-	}
-	return credential.email?.trim() || void 0;
-}
-//#endregion
-//#region extensions/codex/src/app-server/rate-limit-cache.ts
-const DEFAULT_CODEX_RATE_LIMIT_CACHE_MAX_AGE_MS = 10 * 6e4;
-const SPARSE_ACCOUNT_METADATA_KEYS = [
-	"credits",
-	"individualLimit",
-	"planType"
-];
-const rateLimitsByClient = /* @__PURE__ */ new WeakMap();
-/** Replaces one physical client's cache with an authoritative rate-limit read response. */
-function rememberCodexRateLimitsRead(client, value, nowMs = Date.now()) {
-	if (value !== void 0) {
-		const revisionsByLimitId = { ...rateLimitsByClient.get(client)?.revisionsByLimitId };
-		for (const limitId of readRateLimitIds(value)) revisionsByLimitId[limitId] = (revisionsByLimitId[limitId] ?? 0) + 1;
-		rateLimitsByClient.set(client, {
-			value,
-			updatedAtMs: nowMs,
-			revisionsByLimitId
-		});
-	}
+function readNonEmptyInitializeString(value) {
+	const trimmed = value?.trim();
+	return trimmed ? trimmed : void 0;
 }
-/** Merges a sparse rolling notification into one physical client's latest read response. */
-function mergeCodexRateLimitsUpdate(client, value, nowMs = Date.now()) {
-	const update = isJsonObject$1(value) && isJsonObject$1(value.rateLimits) ? value.rateLimits : void 0;
-	if (!update) return;
-	const currentState = rateLimitsByClient.get(client);
-	const current = currentState?.value;
-	const limitId = readLimitId(update);
-	rateLimitsByClient.set(client, {
-		value: mergeRateLimitUpdate(current, update),
-		updatedAtMs: nowMs,
-		revisionsByLimitId: {
-			...currentState?.revisionsByLimitId,
-			[limitId]: (currentState?.revisionsByLimitId[limitId] ?? 0) + 1
-		}
-	});
+/** Extracts the Codex version from the app-server initialize user-agent field. */
+function readCodexVersionFromUserAgent(userAgent) {
+	return (userAgent?.match(/^[^/]+\/(\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?)(?:[\s(]|$)/))?.[1];
 }
-/** Per-limit marker used to trust only primary Codex updates from one turn startup. */
-function readCodexRateLimitsRevision(client, limitId = "codex") {
-	return rateLimitsByClient.get(client)?.revisionsByLimitId[limitId] ?? 0;
+function redactCodexAppServerLinePreview(value) {
+	const redacted = value.replace(/\s+/g, " ").trim().replace(/(Bearer\s+)[A-Za-z0-9._~+/-]+/gi, "$1<redacted>").replace(/("(?:api_?key|authorization|token|access_token|refresh_token)"\s*:\s*")([^"]+)(")/gi, "$1<redacted>$3").replace(/\b([a-z0-9_]*(?:api_?key|authorization|access_token|refresh_token|token))(\s*=\s*)(["']?)[^\s"']+(\3)/gi, "$1$2$3<redacted>$4");
+	return redacted.length > CODEX_APP_SERVER_PARSE_LOG_MAX ? `${truncateUtf16Safe(redacted, CODEX_APP_SERVER_PARSE_LOG_MAX)}...` : redacted;
 }
-/** Reads one physical client's cached rate-limit payload within the max-age window. */
-function readRecentCodexRateLimits(client, options) {
-	const state = rateLimitsByClient.get(client);
-	if (!state) return;
-	const nowMs = options?.nowMs ?? Date.now();
-	const maxAgeMs = options?.maxAgeMs ?? DEFAULT_CODEX_RATE_LIMIT_CACHE_MAX_AGE_MS;
-	return maxAgeMs >= 0 && nowMs - state.updatedAtMs > maxAgeMs ? void 0 : state.value;
+function appendBoundedTail(current, next, maxLength) {
+	const combined = `${current}${next}`;
+	return combined.length > maxLength ? sliceUtf16Safe(combined, -maxLength) : combined;
 }
-function mergeRateLimitUpdate(current, update) {
-	const currentEnvelope = isJsonObject$1(current) ? current : void 0;
-	const currentPrimary = currentEnvelope && isJsonObject$1(currentEnvelope.rateLimits) ? currentEnvelope.rateLimits : void 0;
-	const currentByLimitId = currentEnvelope && isJsonObject$1(currentEnvelope.rateLimitsByLimitId) ? currentEnvelope.rateLimitsByLimitId : void 0;
-	const limitId = readLimitId(update);
-	const currentPrimaryLimitId = currentPrimary ? readLimitId(currentPrimary) : void 0;
-	const currentForLimit = (currentByLimitId && isJsonObject$1(currentByLimitId[limitId]) ? currentByLimitId[limitId] : void 0) ?? (currentPrimaryLimitId === limitId ? currentPrimary : void 0);
-	const merged = mergeSparseSnapshot(isJsonObject$1(currentForLimit) ? currentForLimit : void 0, currentPrimary, update, limitId);
-	const nextPrimary = !currentPrimary || currentPrimaryLimitId === limitId ? merged : currentPrimary;
-	let nextByLimitId;
-	if (currentByLimitId) nextByLimitId = {
-		...currentByLimitId,
-		[limitId]: merged
-	};
-	else if (currentPrimary && currentPrimaryLimitId && currentPrimaryLimitId !== limitId) nextByLimitId = {
-		[currentPrimaryLimitId]: currentPrimary,
-		[limitId]: merged
-	};
-	return {
-		...currentEnvelope,
-		rateLimits: nextPrimary,
-		...nextByLimitId ? { rateLimitsByLimitId: nextByLimitId } : {}
-	};
+function buildCodexAppServerExitError(code, signal, stderrTail) {
+	const stderrPreview = redactCodexAppServerLinePreview(stderrTail);
+	const suffix = stderrPreview ? ` stderr=${JSON.stringify(stderrPreview)}` : "";
+	return /* @__PURE__ */ new Error(`codex app-server exited: code=${formatExitValue(code)} signal=${formatExitValue(signal)}${suffix}`);
 }
-function readRateLimitIds(value) {
-	if (!isJsonObject$1(value)) return [];
-	const ids = /* @__PURE__ */ new Set();
-	if (isJsonObject$1(value.rateLimits)) ids.add(readLimitId(value.rateLimits));
-	if (isJsonObject$1(value.rateLimitsByLimitId)) for (const [key, snapshot] of Object.entries(value.rateLimitsByLimitId)) {
-		const snapshotLimitId = isJsonObject$1(snapshot) && typeof snapshot.limitId === "string" ? snapshot.limitId.trim() : "";
-		ids.add(snapshotLimitId || key);
-	}
-	return [...ids];
+function shouldBufferCodexAppServerParseFailure(value, error) {
+	if (!value.startsWith("{") && !value.startsWith("[")) return false;
+	const message = error instanceof Error ? error.message : String(error);
+	return message.includes("Unterminated string") || message.includes("Unexpected end of JSON input");
 }
-function mergeSparseSnapshot(current, accountFallback, update, limitId) {
-	const merged = {
-		...update,
-		limitId
-	};
-	for (const key of SPARSE_ACCOUNT_METADATA_KEYS) {
-		const previous = current?.[key] ?? accountFallback?.[key];
-		if (merged[key] == null && previous != null) merged[key] = previous;
-	}
-	return merged;
+function logCodexAppServerParseFailure(value, error, fragmentCount) {
+	const linePreview = redactCodexAppServerLinePreview(value);
+	const suffix = fragmentCount > 1 ? ` fragments=${fragmentCount}` : "";
+	embeddedAgentLog.warn("failed to parse codex app-server message", {
+		error,
+		errorMessage: error instanceof Error ? error.message : String(error),
+		fragmentCount,
+		linePreview,
+		consoleMessage: `failed to parse codex app-server message${suffix}: preview=${JSON.stringify(linePreview)}`
+	});
 }
-function readLimitId(snapshot) {
-	const value = snapshot.limitId;
-	return typeof value === "string" && value.trim() ? value.trim() : "codex";
+const CODEX_APP_SERVER_APPROVAL_REQUEST_METHODS = /* @__PURE__ */ new Set([
+	"item/commandExecution/requestApproval",
+	"item/fileChange/requestApproval",
+	"item/permissions/requestApproval"
+]);
+/** Returns true for app-server approval request methods OpenClaw can answer. */
+function isCodexAppServerApprovalRequest(method) {
+	return CODEX_APP_SERVER_APPROVAL_REQUEST_METHODS.has(method);
 }
-//#endregion
-//#region extensions/codex/src/app-server/client-runtime.ts
-/** Client-scoped Codex auth and account observers. */
-const configuredClients = /* @__PURE__ */ new WeakMap();
-/** Installs one auth-refresh handler and one rate-limit observer per physical client. */
-function ensureCodexAppServerClientRuntime(client, context) {
-	const existing = configuredClients.get(client);
-	if (existing) {
-		existing.context = context;
-		return;
-	}
-	const runtime = { context };
-	configuredClients.set(client, runtime);
-	client.addRequestHandler(async (request) => {
-		if (request.method !== "account/chatgptAuthTokens/refresh") return;
-		if (runtime.context.authMode === "prepared-api-key") throw new Error("ChatGPT token refresh is unavailable for prepared Codex API-key auth.");
-		return await refreshCodexAppServerAuthTokens({
-			agentDir: runtime.context.agentDir,
-			authProfileId: runtime.context.authProfileId,
-			...runtime.context.authProfileStore ? { authProfileStore: runtime.context.authProfileStore } : {},
-			config: runtime.context.config
-		});
-	});
-	client.addNotificationHandler((notification) => {
-		if (notification.method === "account/rateLimits/updated") mergeCodexRateLimitsUpdate(client, notification.params);
-	});
+function formatExitValue(value) {
+	if (value === null || value === void 0) return "null";
+	if (typeof value === "string" || typeof value === "number") return String(value);
+	return "unknown";
 }
 //#endregion
 //#region extensions/codex/src/app-server/managed-binary.ts
@@ -2152,6 +2303,7 @@ var shared_client_exports = /* @__PURE__ */ __exportAll({
 	clearSharedCodexAppServerClientIfCurrentAndWait: () => clearSharedCodexAppServerClientIfCurrentAndWait,
 	createIsolatedCodexAppServerClient: () => createIsolatedCodexAppServerClient,
 	getLeasedSharedCodexAppServerClient: () => getLeasedSharedCodexAppServerClient,
+	getSharedCodexAppServerClient: () => getSharedCodexAppServerClient,
 	isCodexAppServerStartSelectionChangedError: () => isCodexAppServerStartSelectionChangedError,
 	releaseCodexAppServerClientLease: () => releaseCodexAppServerClientLease,
 	releaseLeasedSharedCodexAppServerClient: () => releaseLeasedSharedCodexAppServerClient,
@@ -2292,6 +2444,10 @@ async function resolveCodexAppServerClientStartContext(options) {
 		})
 	};
 }
+/** Gets or starts a shared Codex app-server client without retaining a lease. */
+async function getSharedCodexAppServerClient(options) {
+	return (await acquireSharedCodexAppServerClient(options)).client;
+}
 /** Gets or starts a shared Codex app-server client and records a release lease. */
 async function getLeasedSharedCodexAppServerClient(options) {
 	const acquired = await acquireSharedCodexAppServerClient(options, { leased: true });
@@ -2793,4 +2949,4 @@ function collectSharedClients(state) {
 	return [...new Set([...state.clients.values()].map((entry) => entry.client).filter((client) => Boolean(client)))];
 }
 //#endregion
-export { isCodexAppServerStartupError as A, isCodexAppServerApprovalRequest as B, resolveCodexAppServerFallbackApiKeyCacheKey as C, resolveCodexAppServerHomeDir as D, resolveFirstExistingMacOSDesktopCodexBundledMarketplacePath as E, resolveCodexTurnCompletionIdleTimeoutMs as F, isCodexAppServerPrewriteRequestCancellationError as G, isCodexAppServerConnectionClosedError as H, resolveCodexTurnTerminalIdleTimeoutMs as I, CODEX_INTERACTIVE_CUSTOM_THREAD_SOURCES as J, isCodexAppServerRequestTimeoutError as K, withCodexStartupTimeout as L, resolveCodexPostToolRawAssistantCompletionIdleTimeoutMs as M, resolveCodexStartupTimeoutMs as N, CODEX_POST_REASONING_REPLY_IDLE_TIMEOUT_MS as O, resolveCodexTurnAssistantCompletionIdleTimeoutMs as P, isJsonObject$1 as Q, CodexAppServerRpcError as R, resolveCodexAppServerAuthProfileIdForAgent as S, resolveCodexAppServerPreparedAuthHandoff as T, isCodexAppServerIndeterminateRequestCancellationError as U, isCodexAppServerBrokenPipeError as V, isCodexAppServerIndeterminateTransportError as W, CODEX_OPENCLAW_DIRECT_DYNAMIC_TOOL_NAMESPACE as X, CODEX_INTERACTIVE_THREAD_SOURCE_KINDS as Y, flattenCodexDynamicToolFunctions as Z, readCodexRateLimitsRevision as _, getLeasedSharedCodexAppServerClient as a, resolveCodexAppServerAuthAccountCacheKey as b, releaseLeasedSharedCodexAppServerClient as c, retireSharedCodexAppServerClientIfCurrent as d, shared_client_exports as f, ensureCodexAppServerClientRuntime as g, acquireCodexNativeConfigFence as h, createIsolatedCodexAppServerClient as i, resolveCodexGatewayTimeoutWithGraceMs as j, CodexAppServerStartupError as k, resolveCodexNativeConfigFenceKey as l, withTimeout$1 as m, clearSharedCodexAppServerClientIfCurrentAndUnclaimed as n, isCodexAppServerStartSelectionChangedError as o, withLeasedCodexAppServerClientStartSelectionRetry as p, resolveCodexAppServerClientInstanceId as q, clearSharedCodexAppServerClientIfCurrentAndWait as r, releaseCodexAppServerClientLease as s, clearSharedCodexAppServerClientIfCurrent as t, retainSharedCodexAppServerClientIfCurrent as u, readRecentCodexRateLimits as v, resolveCodexAppServerPreparedApiKeyCacheKey as w, resolveCodexAppServerAuthProfileId as x, rememberCodexRateLimitsRead as y, getCodexAppServerClientInstanceId as z };
+export { withCodexStartupTimeout as $, rememberCodexRateLimitsRead as A, flattenCodexDynamicToolFunctions as B, isCodexAppServerIndeterminateTransportError as C, ensureCodexAppServerClientRuntime as D, resolveCodexAppServerClientInstanceId as E, resolveCodexAppServerPreparedApiKeyCacheKey as F, CodexAppServerStartupError as G, resolveFirstExistingMacOSDesktopCodexBundledMarketplacePath as H, resolveCodexAppServerPreparedAuthHandoff as I, resolveCodexPostToolRawAssistantCompletionIdleTimeoutMs as J, isCodexAppServerStartupError as K, CODEX_INTERACTIVE_CUSTOM_THREAD_SOURCES as L, resolveCodexAppServerAuthProfileId as M, resolveCodexAppServerAuthProfileIdForAgent as N, readCodexRateLimitsRevision as O, resolveCodexAppServerFallbackApiKeyCacheKey as P, resolveCodexTurnTerminalIdleTimeoutMs as Q, CODEX_INTERACTIVE_THREAD_SOURCE_KINDS as R, isCodexAppServerIndeterminateRequestCancellationError as S, isCodexAppServerRequestTimeoutError as T, resolveCodexAppServerHomeDir as U, isJsonObject$1 as V, CODEX_POST_REASONING_REPLY_IDLE_TIMEOUT_MS as W, resolveCodexTurnAssistantCompletionIdleTimeoutMs as X, resolveCodexStartupTimeoutMs as Y, resolveCodexTurnCompletionIdleTimeoutMs as Z, CodexAppServerRpcError as _, getLeasedSharedCodexAppServerClient as a, isCodexAppServerBrokenPipeError as b, releaseCodexAppServerClientLease as c, retainSharedCodexAppServerClientIfCurrent as d, retireSharedCodexAppServerClientIfCurrent as f, acquireCodexNativeConfigFence as g, withTimeout$1 as h, createIsolatedCodexAppServerClient as i, resolveCodexAppServerAuthAccountCacheKey as j, readRecentCodexRateLimits as k, releaseLeasedSharedCodexAppServerClient as l, withLeasedCodexAppServerClientStartSelectionRetry as m, clearSharedCodexAppServerClientIfCurrentAndUnclaimed as n, getSharedCodexAppServerClient as o, shared_client_exports as p, resolveCodexGatewayTimeoutWithGraceMs as q, clearSharedCodexAppServerClientIfCurrentAndWait as r, isCodexAppServerStartSelectionChangedError as s, clearSharedCodexAppServerClientIfCurrent as t, resolveCodexNativeConfigFenceKey as u, getCodexAppServerClientInstanceId as v, isCodexAppServerPrewriteRequestCancellationError as w, isCodexAppServerConnectionClosedError as x, isCodexAppServerApprovalRequest as y, CODEX_OPENCLAW_DIRECT_DYNAMIC_TOOL_NAMESPACE as z };