@openclaw/codex 2026.7.2-beta.4 → 2026.7.2-beta.5

package/dist/index.js

@@ -1,22 +1,24 @@
 import { registerCodexCliMetadata } from "./cli-metadata.js";
 import { createCodexAppServerAgentHarness } from "./harness.js";
-import { C as resolveCodexAppServerFallbackApiKeyCacheKey, Q as isJsonObject, S as resolveCodexAppServerAuthProfileIdForAgent, Y as CODEX_INTERACTIVE_THREAD_SOURCE_KINDS, a as getLeasedSharedCodexAppServerClient, b as resolveCodexAppServerAuthAccountCacheKey, c as releaseLeasedSharedCodexAppServerClient, p as withLeasedCodexAppServerClientStartSelectionRetry, r as clearSharedCodexAppServerClientIfCurrentAndWait, s as releaseCodexAppServerClientLease } from "./shared-client-wmgNFNYp.js";
-import { D as resolveCodexSupervisionAppServerRuntimeOptions, O as resolveOpenClawExecPolicyForCodexAppServer, b as readCodexPluginConfig, d as CODEX_PLUGINS_MARKETPLACE_NAME, g as codexSandboxPolicyForTurn, h as codexAppServerStartOptionsKey, l as sessionBindingIdentity, m as canUseCodexModelBackedApprovalsReviewerForModel, n as assertCodexBindingMayBeReplaced, o as isCodexAppServerNativeAuthProfile, p as assertCodexAppServerConnectionSecurity, s as normalizeCodexAppServerBindingModelProvider, x as resolveCodexAppServerRuntimeOptions } from "./session-binding-ZSMX1omP.js";
-import { N as CODEX_APP_SERVER_UNSUBSCRIBE_TIMEOUT_MS, R as unsubscribeCodexThreadBestEffort, _ as CODEX_NATIVE_PERSONALITY_NONE, c as resumeCodexAppServerThread, et as ensureCodexPluginActivation, tt as pluginReadParams, y as resolveCodexAppServerRequestModelSelection } from "./thread-lifecycle-cqrOlJkq.js";
-import { _ as assertCodexThreadStartResponse } from "./transcript-mirror-2p7kl6e4.js";
-import { i as defaultCodexAppInventoryCache, r as buildCodexPluginAppCacheKey } from "./plugin-app-cache-key-CvzvmBRz.js";
+import { N as resolveCodexAppServerAuthProfileIdForAgent, P as resolveCodexAppServerFallbackApiKeyCacheKey, R as CODEX_INTERACTIVE_THREAD_SOURCE_KINDS, V as isJsonObject, a as getLeasedSharedCodexAppServerClient, c as releaseCodexAppServerClientLease, j as resolveCodexAppServerAuthAccountCacheKey, l as releaseLeasedSharedCodexAppServerClient, m as withLeasedCodexAppServerClientStartSelectionRetry, r as clearSharedCodexAppServerClientIfCurrentAndWait } from "./shared-client-BVKE40c-.js";
+import { D as resolveOpenClawExecPolicyForCodexAppServer, T as readCodexPluginConfig, _ as assertCodexAppServerConnectionSecurity, b as canUseCodexModelBackedApprovalsReviewerForModel, d as codexAppServerStartOptionsKey, f as codexSandboxPolicyForTurn, g as resolveCodexSupervisionAppServerRuntimeOptions, k as CODEX_PLUGINS_MARKETPLACE_NAME, l as sessionBindingIdentity, n as assertCodexBindingMayBeReplaced, o as isCodexAppServerNativeAuthProfile, p as resolveCodexAppServerRuntimeOptions, s as normalizeCodexAppServerBindingModelProvider } from "./session-binding-DlVQ-Pxs.js";
 import { n as CODEX_APP_SERVER_BINDING_NAMESPACE, t as CODEX_APP_SERVER_BINDING_MAX_ENTRIES } from "./session-binding-meta-B7aEMU7g.js";
+import { n as CODEX_APP_SERVER_UNSUBSCRIBE_TIMEOUT_MS, u as unsubscribeCodexThreadBestEffort } from "./attempt-client-cleanup-Ia52yRWc.js";
+import { J as pluginReadParams, _ as CODEX_NATIVE_PERSONALITY_NONE, c as resumeCodexAppServerThread, q as ensureCodexPluginActivation, y as resolveCodexAppServerRequestModelSelection } from "./thread-lifecycle-DRg_FdzC.js";
+import { i as assertCodexThreadStartResponse } from "./protocol-validators-Dm4eXZmt.js";
+import { i as defaultCodexAppInventoryCache, r as buildCodexPluginAppCacheKey } from "./plugin-app-cache-key-DSXX-rXO.js";
 import { t as isIncognitoSessionKey } from "./incognito-session-ET_ufDH-.js";
 import { buildCodexMediaUnderstandingProvider } from "./media-understanding-provider.js";
-import { n as describeControlFailure, t as CODEX_CONTROL_METHODS } from "./capabilities-CLICvTxf.js";
-import { r as formatCodexDisplayText } from "./command-formatters-DgADqnHa.js";
-import { t as resolveCodexAppServerForModelProvider } from "./app-server-policy-BO3jYBkv.js";
+import { n as CODEX_REALTIME_OFFER_PATH, t as configureCodexRealtimeBrowserSession } from "./realtime-voice-api-BPcA1uN9.js";
+import { n as describeControlFailure, t as CODEX_CONTROL_METHODS } from "./capabilities-BHRSI6Cn.js";
+import { r as formatCodexDisplayText } from "./command-formatters-ico4ZFnk.js";
+import { t as resolveCodexAppServerForModelProvider } from "./app-server-policy-BmDgseo_.js";
 import { n as resolveCodexNativeExecutionBlock, r as resolveCodexNativeSandboxBlock } from "./sandbox-guard-D1Wky__S.js";
-import { d as CODEX_NATIVE_EXECUTION_AUTH_ERROR, f as canMutateCodexHost, u as trackCodexConversationActiveTurn } from "./conversation-control-sNPsbTCP.js";
+import { d as CODEX_NATIVE_EXECUTION_AUTH_ERROR, f as canMutateCodexHost, u as trackCodexConversationActiveTurn } from "./conversation-control-DE7d9DOj.js";
 import { a as readCodexConversationBindingDataRecord, i as readCodexConversationBindingData, o as resolveCodexDefaultWorkspaceDir, r as createCodexConversationBindingData } from "./conversation-binding-data-BHRpYbX3.js";
-import { a as resolveCodexBindingAppServerConnection, n as readCodexNotificationThreadId, r as readCodexNotificationTurnId } from "./notification-correlation-BGLixv5_.js";
-import { d as createCodexCliSessionNodeHostCommands, f as createCodexCliSessionNodeInvokePolicies, g as resumeCodexCliSessionOnNode, h as resolveCodexCliSessionForBindingOnNode, i as createCodexSessionCatalogNodeInvokePolicies, m as listCodexCliSessionsOnNode, n as createCodexSessionCatalogControl, o as codexControlRequest, r as createCodexSessionCatalogNodeHostCommands, t as codexSessionCatalogRuntime, u as assertCodexArchiveDescendantsUnowned } from "./session-catalog-DsKaezgR.js";
-import { r as requestCodexAppServerJson } from "./request-BTccUTD3.js";
+import { a as resolveCodexBindingAppServerConnection, n as readCodexNotificationThreadId, r as readCodexNotificationTurnId } from "./notification-correlation-Bj_Ak_jI.js";
+import { d as createCodexCliSessionNodeHostCommands, f as createCodexCliSessionNodeInvokePolicies, g as resumeCodexCliSessionOnNode, h as resolveCodexCliSessionForBindingOnNode, i as createCodexSessionCatalogNodeInvokePolicies, m as listCodexCliSessionsOnNode, n as createCodexSessionCatalogControl, o as codexControlRequest, r as createCodexSessionCatalogNodeHostCommands, t as codexSessionCatalogRuntime, u as assertCodexArchiveDescendantsUnowned } from "./session-catalog-CP2oCcEb.js";
+import { r as requestCodexAppServerJson } from "./request-CXpPennK.js";
 import { t as createCodexWebSearchProviderBase } from "./web-search-provider.shared-BrZmlqyR.js";
 import { mutateConfigFile } from "openclaw/plugin-sdk/config-mutation";
 import { normalizePluginsConfig, resolveEffectiveEnableState, resolveLivePluginConfigObject, resolvePluginConfigObject } from "openclaw/plugin-sdk/plugin-config-runtime";
@@ -24,19 +26,19 @@ import { definePluginEntry } from "openclaw/plugin-sdk/plugin-entry";
 import fs from "node:fs/promises";
 import path from "node:path";
 import { parseStrictNonNegativeInteger, resolveTimerTimeoutMs } from "openclaw/plugin-sdk/number-runtime";
+import { formatErrorMessage, resolveSandboxContext } from "openclaw/plugin-sdk/agent-harness-runtime";
+import { loadAuthProfileStoreWithoutExternalProfiles, resolveAgentConfig, resolveAgentWorkspaceDir, resolveDefaultAgentDir, resolveDefaultAgentId, resolveSessionAgentIds as resolveSessionAgentIds$1 } from "openclaw/plugin-sdk/agent-runtime";
 import os from "node:os";
-import { loadAuthProfileStoreWithoutExternalProfiles, resolveAgentConfig, resolveAgentWorkspaceDir, resolveDefaultAgentDir, resolveDefaultAgentId, resolveSessionAgentIds } from "openclaw/plugin-sdk/agent-runtime";
+import { applyAuthProfileConfig, buildApiKeyCredential, buildOauthProviderAuthResult, buildOpenAICodexCredentialExtra, readCodexCliCredentialsCached, resolveOpenAICodexAuthIdentity, resolveOpenAICodexImportProfileName, updateAuthProfileStoreWithLock } from "openclaw/plugin-sdk/provider-auth";
 import { loadExecApprovals } from "openclaw/plugin-sdk/exec-approvals-runtime";
 import { asBoolean, asOptionalRecord, isRecord, normalizeOptionalString, normalizeSingleOrTrimmedStringList, uniqueStrings } from "openclaw/plugin-sdk/string-coerce-runtime";
-import { formatErrorMessage, resolveSandboxContext } from "openclaw/plugin-sdk/agent-harness-runtime";
-import { applyAuthProfileConfig, buildApiKeyCredential, buildOauthProviderAuthResult, buildOpenAICodexCredentialExtra, readCodexCliCredentialsCached, resolveOpenAICodexAuthIdentity, resolveOpenAICodexImportProfileName, updateAuthProfileStoreWithLock } from "openclaw/plugin-sdk/provider-auth";
 import { getSessionEntry, resolveStorePath } from "openclaw/plugin-sdk/session-store-runtime";
 import { fileURLToPath } from "node:url";
 import { expectDefined } from "openclaw/plugin-sdk/expect-runtime";
-import { canonicalPathFromExistingAncestor, isPathInside, pathExists } from "openclaw/plugin-sdk/security-runtime";
+import { canonicalPathFromExistingAncestor, extractErrorCode, isPathInside, pathExists } from "openclaw/plugin-sdk/security-runtime";
 import { KeyedAsyncQueue } from "openclaw/plugin-sdk/keyed-async-queue";
 import { ModelSelectionLockedError, isModelSelectionLocked } from "openclaw/plugin-sdk/model-session-runtime";
-import { MIGRATION_REASON_TARGET_EXISTS, applyMigrationManualItem, createMigrationItem, createMigrationManualItem, hasMigrationConfigPatchConflict, markMigrationItemConflict, markMigrationItemError, markMigrationItemSkipped, readMigrationConfigPath, resolveMigrationConfigRuntime, summarizeMigrationItems, writeMigrationConfigPath } from "openclaw/plugin-sdk/migration";
+import { MIGRATION_REASON_TARGET_EXISTS, applyMigrationManualItem, createMigrationItem, createMigrationManualItem, hasMigrationConfigPatchConflict, markMigrationItemConflict, markMigrationItemError, markMigrationItemSkipped, mergeMigrationConfigValue, readMigrationConfigPath, resolveMigrationConfigRuntime, summarizeMigrationItems, writeMigrationConfigPath } from "openclaw/plugin-sdk/migration";
 import { archiveMigrationItem, copyMemoryMigrationFileItem, copyMigrationFileItem, withCachedMigrationConfigRuntime, writeMigrationReport } from "openclaw/plugin-sdk/migration-runtime";
 import { sleep } from "openclaw/plugin-sdk/runtime-env";
 import { readJsonFileWithFallback } from "openclaw/plugin-sdk/json-store";
@@ -47,13 +49,14 @@ import { createLazyRuntimeModule } from "openclaw/plugin-sdk/lazy-runtime";
 /** Defers schema compilation and auth loading until the first binding operation. */
 function createLazyCodexAppServerBindingStore(state) {
 	let resolved;
-	const store = () => resolved ??= import("./session-binding-ZSMX1omP.js").then((n) => n.u).then(({ createCodexAppServerBindingStore }) => createCodexAppServerBindingStore(state));
+	const store = () => resolved ??= import("./session-binding-DlVQ-Pxs.js").then((n) => n.u).then(({ createCodexAppServerBindingStore }) => createCodexAppServerBindingStore(state));
 	return {
 		read: async (identity) => (await store()).read(identity),
 		hasOtherThreadOwner: async (threadId, currentIdentity) => (await store()).hasOtherThreadOwner(threadId, currentIdentity),
 		mutate: async (identity, mutation) => (await store()).mutate(identity, mutation),
 		prepareSessionGenerationReclaim: async (identity) => (await store()).prepareSessionGenerationReclaim(identity),
 		adoptSessionGeneration: async (identity, previousSessionId) => (await store()).adoptSessionGeneration(identity, previousSessionId),
+		resetSessionGeneration: async (identity) => (await store()).resetSessionGeneration(identity),
 		retireSessionGeneration: async (identity) => (await store()).retireSessionGeneration(identity),
 		withThreadArchiveFence: async (run) => (await store()).withThreadArchiveFence(run),
 		withLease: async (identity, run) => (await store()).withLease(identity, run)
@@ -74,7 +77,7 @@ async function handleCodexCommand(ctx, options) {
 	}
 }
 async function loadDefaultCodexSubcommandHandler() {
-	const { handleCodexSubcommand } = await import("./command-handlers-l_lVPNlB.js");
+	const { handleCodexSubcommand } = await import("./command-handlers-CRmnwI2N.js");
 	return handleCodexSubcommand;
 }
 //#endregion
@@ -937,7 +940,7 @@ async function prepareConversationBinding(params, options = {}) {
 	});
 }
 function resolveConversationExecPolicy(params) {
-	const agentId = params.agentId ?? (params.config ? resolveSessionAgentIds({
+	const agentId = params.agentId ?? (params.config ? resolveSessionAgentIds$1({
 		sessionKey: params.sessionKey,
 		config: params.config
 	}).sessionAgentId : void 0);
@@ -1138,11 +1141,6 @@ async function readModelRefs(source) {
 	refs.add(OPENAI_CODEX_DEFAULT_MODEL);
 	return [...refs].toSorted();
 }
-function readProviderAuthModelConfigs(result) {
-	const models = result.configPatch?.agents?.defaults?.models;
-	if (isRecord(models)) return { ...models };
-	return { [normalizeOptionalString(result.defaultModel) ?? OPENAI_CODEX_DEFAULT_MODEL]: {} };
-}
 async function buildCodexOAuthCredential(source) {
 	const credential = readCodexCliCredentialsCached({
 		codexHome: source.codexHome,
@@ -1177,8 +1175,7 @@ async function buildCodexOAuthCredential(source) {
 		kind: "oauth",
 		provider: OPENAI_PROVIDER_ID,
 		profileId: profile.profileId,
-		result,
-		modelConfigs: readProviderAuthModelConfigs(result)
+		result
 	} : null;
 }
 async function buildCodexApiKeyCredential(source) {
@@ -1257,30 +1254,8 @@ function applyDefaultModelIfMissing(cfg) {
 		}
 	};
 }
-function mergeModelConfigEntry(existing, patch) {
-	if (existing && isRecord(existing) && isRecord(patch)) return {
-		...existing,
-		...patch
-	};
-	return existing ?? patch;
-}
-function applyOAuthModelConfigsToConfig(cfg, credential) {
-	const existingModels = cfg.agents?.defaults?.models ?? {};
-	const models = credential.result.replaceDefaultModels ? { ...credential.modelConfigs } : { ...existingModels };
-	if (!credential.result.replaceDefaultModels) for (const [modelRef, modelConfig] of Object.entries(credential.modelConfigs)) models[modelRef] = mergeModelConfigEntry(models[modelRef], modelConfig);
-	return {
-		...cfg,
-		agents: {
-			...cfg.agents,
-			defaults: {
-				...cfg.agents?.defaults,
-				models
-			}
-		}
-	};
-}
 function applyOAuthConfigToConfig(cfg, credential, profileId) {
-	let next = applyOAuthModelConfigsToConfig(cfg, credential);
+	let next = mergeMigrationConfigValue(cfg, credential.result.configPatch);
 	const profile = credential.result.profiles[0];
 	if (profile) next = applyAuthProfileConfig(next, {
 		profileId,
@@ -1304,28 +1279,23 @@ function applyApiKeyConfigToConfig(cfg, credential, profileId) {
 function shouldReturnAuthConfigPatch(ctx) {
 	return ctx.providerOptions?.configPatchMode === CODEX_CONFIG_PATCH_MODE_RETURN$1;
 }
-function oauthAuthProfileConfig(credential, profileId) {
+function authProfileConfigForCredential(credential, profileId) {
+	if (credential.kind === "api_key") return {
+		profileId,
+		provider: credential.provider,
+		mode: "api_key",
+		displayName: CODEX_IMPORT_DISPLAY_NAME
+	};
 	const profile = credential.result.profiles[0];
 	if (!profile || profile.credential.type !== "oauth") return null;
 	return {
 		profileId,
 		provider: profile.credential.provider,
 		mode: "oauth",
-		..."email" in profile.credential && profile.credential.email ? { email: profile.credential.email } : {},
-		..."displayName" in profile.credential && profile.credential.displayName ? { displayName: profile.credential.displayName } : {}
+		...profile.credential.email ? { email: profile.credential.email } : {},
+		...profile.credential.displayName ? { displayName: profile.credential.displayName } : {}
 	};
 }
-function apiKeyAuthProfileConfig(credential, profileId) {
-	return {
-		profileId,
-		provider: credential.provider,
-		mode: "api_key",
-		displayName: CODEX_IMPORT_DISPLAY_NAME
-	};
-}
-function authProfileConfigForCredential(credential, profileId) {
-	return credential.kind === "oauth" ? oauthAuthProfileConfig(credential, profileId) : apiKeyAuthProfileConfig(credential, profileId);
-}
 async function applyCodexAuthProfileConfig(ctx, profile, applyConfig) {
 	const configApi = resolveMigrationConfigRuntime(ctx);
 	if (!configApi?.current || !configApi.mutateConfigFile) return "unavailable";
@@ -1344,13 +1314,13 @@ async function applyCodexAuthProfileConfig(ctx, profile, applyConfig) {
 		return error instanceof CodexAuthConfigConflict ? "conflict" : "unavailable";
 	}
 }
-async function applyOAuthConfig(ctx, credential, profileId) {
-	const profile = oauthAuthProfileConfig(credential, profileId);
+async function applyCodexAuthConfig(ctx, credential, profileId) {
+	const profile = authProfileConfigForCredential(credential, profileId);
 	if (!profile) return "unavailable";
-	return applyCodexAuthProfileConfig(ctx, profile, (config) => applyOAuthConfigToConfig(config, credential, profileId));
+	return applyCodexAuthProfileConfig(ctx, profile, (config) => applyCredentialConfig(config, credential, profileId));
 }
-async function applyApiKeyConfig(ctx, credential, profileId) {
-	return applyCodexAuthProfileConfig(ctx, apiKeyAuthProfileConfig(credential, profileId), (config) => applyApiKeyConfigToConfig(config, credential, profileId));
+function applyCredentialConfig(config, credential, profileId) {
+	return credential.kind === "oauth" ? applyOAuthConfigToConfig(config, credential, profileId) : applyApiKeyConfigToConfig(config, credential, profileId);
 }
 async function buildCodexAuthItems(params) {
 	const credentials = await readCodexAuthCredentials(params.source);
@@ -1383,22 +1353,22 @@ async function buildCodexAuthItems(params) {
 		});
 	});
 }
-async function applyCodexAuthItem(params) {
+async function applyCodexAuthItems(params) {
 	const { ctx, item, source, targets } = params;
-	if (item.status !== "planned") return item;
+	if (item.status !== "planned") return [item];
 	const profileId = typeof item.details?.profileId === "string" ? item.details.profileId : "";
 	const provider = typeof item.details?.provider === "string" ? item.details.provider : "";
 	const sourceProfileId = typeof item.details?.sourceProfileId === "string" ? item.details.sourceProfileId : void 0;
-	if (!profileId || !provider) return markMigrationItemError(item, CODEX_REASON_MISSING_AUTH_METADATA);
+	if (!profileId || !provider) return [markMigrationItemError(item, CODEX_REASON_MISSING_AUTH_METADATA)];
 	const credential = (await readCodexAuthCredentials(source)).find((candidate) => candidate.provider === provider);
-	if (!credential) return markMigrationItemSkipped(item, CODEX_REASON_AUTH_NO_LONGER_PRESENT);
-	if (credential.kind === "oauth" && sourceProfileId && credential.profileId !== sourceProfileId) return markMigrationItemSkipped(item, CODEX_REASON_AUTH_NO_LONGER_PRESENT);
+	if (!credential) return [markMigrationItemSkipped(item, CODEX_REASON_AUTH_NO_LONGER_PRESENT)];
+	if (credential.kind === "oauth" && sourceProfileId && credential.profileId !== sourceProfileId) return [markMigrationItemSkipped(item, CODEX_REASON_AUTH_NO_LONGER_PRESENT)];
 	const oauthProfile = credential.kind === "oauth" ? credential.result.profiles[0] : void 0;
 	const oauthCredential = oauthProfile?.credential.type === "oauth" ? oauthProfile.credential : void 0;
-	if (credential.kind === "oauth" && !oauthCredential) return markMigrationItemError(item, CODEX_REASON_MISSING_AUTH_METADATA);
+	if (credential.kind === "oauth" && !oauthCredential) return [markMigrationItemError(item, CODEX_REASON_MISSING_AUTH_METADATA)];
 	const configProfile = authProfileConfigForCredential(credential, profileId);
-	if (!configProfile) return markMigrationItemError(item, CODEX_REASON_MISSING_AUTH_METADATA);
-	if (hasCurrentAuthProfileConfigConflict(ctx, configProfile)) return markMigrationItemConflict(item, CODEX_REASON_AUTH_PROFILE_EXISTS);
+	if (!configProfile) return [markMigrationItemError(item, CODEX_REASON_MISSING_AUTH_METADATA)];
+	if (hasCurrentAuthProfileConfigConflict(ctx, configProfile)) return [markMigrationItemConflict(item, CODEX_REASON_AUTH_PROFILE_EXISTS)];
 	let conflicted = false;
 	let wrote = false;
 	const store = await updateAuthProfileStoreWithLock({
@@ -1422,11 +1392,11 @@ async function applyCodexAuthItem(params) {
 			return true;
 		}
 	});
-	if (conflicted) return markMigrationItemConflict(item, CODEX_REASON_AUTH_PROFILE_EXISTS);
-	if (!store?.profiles[profileId]) return markMigrationItemError(item, CODEX_REASON_AUTH_PROFILE_WRITE_FAILED);
-	const configResult = shouldReturnAuthConfigPatch(ctx) ? "unavailable" : credential.kind === "oauth" ? await applyOAuthConfig(ctx, credential, profileId) : await applyApiKeyConfig(ctx, credential, profileId);
-	if (configResult === "conflict") return markMigrationItemConflict(item, CODEX_REASON_AUTH_PROFILE_EXISTS);
-	return {
+	if (conflicted) return [markMigrationItemConflict(item, CODEX_REASON_AUTH_PROFILE_EXISTS)];
+	if (!store?.profiles[profileId]) return [markMigrationItemError(item, CODEX_REASON_AUTH_PROFILE_WRITE_FAILED)];
+	const configResult = shouldReturnAuthConfigPatch(ctx) ? "unavailable" : await applyCodexAuthConfig(ctx, credential, profileId);
+	if (configResult === "conflict") return [markMigrationItemConflict(item, CODEX_REASON_AUTH_PROFILE_EXISTS)];
+	const migratedItem = {
 		...item,
 		status: "migrated",
 		details: {
@@ -1436,18 +1406,10 @@ async function applyCodexAuthItem(params) {
 			...shouldReturnAuthConfigPatch(ctx) ? { configPatchReturned: true } : {}
 		}
 	};
+	return [migratedItem, ...shouldReturnAuthConfigPatch(ctx) ? buildCodexAuthConfigPatchItems(ctx, migratedItem, credential, profileId) : []];
 }
-async function buildCodexAuthConfigPatchItems(params) {
-	const { ctx, item, source } = params;
-	if (item.status !== "migrated" || !shouldReturnAuthConfigPatch(ctx)) return [];
-	const profileId = typeof item.details?.profileId === "string" ? item.details.profileId : "";
-	const provider = typeof item.details?.provider === "string" ? item.details.provider : "";
-	const sourceProfileId = typeof item.details?.sourceProfileId === "string" ? item.details.sourceProfileId : void 0;
-	if (!profileId || !provider) return [];
-	const credential = (await readCodexAuthCredentials(source)).find((candidate) => candidate.provider === provider);
-	if (!credential) return [];
-	if (credential.kind === "oauth" && sourceProfileId && credential.profileId !== sourceProfileId) return [];
-	const next = credential.kind === "oauth" ? applyOAuthConfigToConfig(ctx.config, credential, profileId) : applyApiKeyConfigToConfig(ctx.config, credential, profileId);
+function buildCodexAuthConfigPatchItems(ctx, item, credential, profileId) {
+	const next = applyCredentialConfig(ctx.config, credential, profileId);
 	const items = [];
 	if (next.auth) items.push(createMigrationItem({
 		id: `${item.id}:config:auth`,
@@ -1476,108 +1438,6 @@ async function buildCodexAuthConfigPatchItems(params) {
 	return items;
 }
 //#endregion
-//#region extensions/codex/src/migration/memory-plan.ts
-const MIGRATION_REASON_TARGET_NOT_REGULAR = "target is not a regular file";
-async function lstatIfExists(filePath) {
-	try {
-		return await fs.lstat(filePath);
-	} catch (error) {
-		const code = error && typeof error === "object" && "code" in error ? String(error.code) : void 0;
-		if (code === "ENOENT" || code === "ENOTDIR") return;
-		throw error;
-	}
-}
-async function assertSafeMemoryDestination(params) {
-	const [canonicalSource, canonicalWorkspace, canonicalTarget] = await Promise.all([
-		fs.realpath(path.dirname(params.source)),
-		canonicalPathFromExistingAncestor(params.workspaceDir),
-		canonicalPathFromExistingAncestor(params.target)
-	]);
-	if (!isPathInside(canonicalWorkspace, canonicalTarget)) throw new Error("Codex memory import destination must stay in the selected workspace.");
-	if (isPathInside(canonicalSource, canonicalTarget) || isPathInside(canonicalTarget, canonicalSource)) throw new Error("Codex memory source and OpenClaw import destination must be separate paths.");
-}
-async function buildCodexMemoryItems(params) {
-	const items = [];
-	for (const memory of params.memoryFiles) {
-		const target = path.join(params.workspaceDir, "memory", "imports", "codex", path.basename(memory.path));
-		const targetStat = await lstatIfExists(target);
-		const targetExists = targetStat !== void 0;
-		const targetNotRegular = targetExists && !targetStat.isFile();
-		if (!targetNotRegular) await assertSafeMemoryDestination({
-			source: memory.path,
-			workspaceDir: params.workspaceDir,
-			target
-		});
-		const targetConflict = targetNotRegular || targetExists && !params.overwrite;
-		items.push(createMigrationItem({
-			id: memory.id,
-			kind: "memory",
-			action: "copy",
-			source: memory.path,
-			target,
-			status: targetConflict ? "conflict" : "planned",
-			reason: targetNotRegular ? MIGRATION_REASON_TARGET_NOT_REGULAR : targetConflict ? MIGRATION_REASON_TARGET_EXISTS : void 0,
-			message: "Copy consolidated Codex memory into the OpenClaw memory index.",
-			details: {
-				sourceType: "codex-memory",
-				sourceLabel: memory.label,
-				collectionId: "codex",
-				collectionLabel: "Codex",
-				relativePath: path.basename(memory.path)
-			}
-		}));
-	}
-	return items;
-}
-//#endregion
-//#region extensions/codex/src/migration/skill-plan.ts
-function uniqueSkillName(skill, counts) {
-	const base = sanitizeName(skill.name) || "codex-skill";
-	if ((counts.get(base) ?? 0) <= 1) return base;
-	return sanitizeName([
-		"codex",
-		sanitizeName(path.basename(path.dirname(skill.source))),
-		base
-	].filter(Boolean).join("-")) || base;
-}
-async function buildCodexSkillItems(params) {
-	const baseCounts = /* @__PURE__ */ new Map();
-	for (const skill of params.skills) {
-		const base = sanitizeName(skill.name) || "codex-skill";
-		baseCounts.set(base, (baseCounts.get(base) ?? 0) + 1);
-	}
-	const resolvedCounts = /* @__PURE__ */ new Map();
-	const planned = params.skills.map((skill) => {
-		const name = uniqueSkillName(skill, baseCounts);
-		resolvedCounts.set(name, (resolvedCounts.get(name) ?? 0) + 1);
-		return {
-			skill,
-			name,
-			target: path.join(params.workspaceDir, "skills", name)
-		};
-	});
-	const items = [];
-	for (const item of planned) {
-		const collides = (resolvedCounts.get(item.name) ?? 0) > 1;
-		const targetExists = await exists(item.target);
-		items.push(createMigrationItem({
-			id: `skill:${item.name}`,
-			kind: "skill",
-			action: "copy",
-			source: item.skill.source,
-			target: item.target,
-			status: collides ? "conflict" : targetExists && !params.overwrite ? "conflict" : "planned",
-			reason: collides ? `multiple Codex skills normalize to "${item.name}"` : targetExists && !params.overwrite ? MIGRATION_REASON_TARGET_EXISTS : void 0,
-			message: `Copy ${item.skill.sourceLabel} into this OpenClaw agent workspace.`,
-			details: {
-				skillName: item.name,
-				sourceLabel: item.skill.sourceLabel
-			}
-		}));
-	}
-	return items;
-}
-//#endregion
 //#region extensions/codex/src/migration/source-files.ts
 const SKILL_FILENAME = "SKILL.md";
 const MAX_SCAN_DEPTH = 6;
@@ -1618,8 +1478,6 @@ async function discoverPluginDirs(codexHome) {
 			discovered.set(dir, {
 				name: manifestName || path.basename(dir),
 				source: dir,
-				manifestPath,
-				sourceKind: "cache",
 				migratable: false,
 				message: "Cached Codex plugin bundle found. Review manually unless the plugin is also installed in the source Codex app-server inventory"
 			});
@@ -1643,7 +1501,7 @@ async function discoverCodexMemoryFile(candidate) {
 }
 async function discoverCodexMemorySources(codexHome) {
 	const memoriesDir = path.join(codexHome, "memories");
-	const memoryFiles = (await Promise.all([{
+	return (await Promise.all([{
 		id: "memory:codex:MEMORY.md",
 		label: "Codex consolidated memory",
 		name: "MEMORY.md"
@@ -1656,10 +1514,6 @@ async function discoverCodexMemorySources(codexHome) {
 		label: candidate.label,
 		path: path.join(memoriesDir, candidate.name)
 	})))).filter((entry) => entry !== void 0);
-	return {
-		...await isDirectory(memoriesDir) ? { memoriesDir } : {},
-		memoryFiles
-	};
 }
 //#endregion
 //#region extensions/codex/src/migration/source.ts
@@ -1731,7 +1585,6 @@ function buildInstalledPluginSource(plugin) {
 		pluginName,
 		marketplaceName: CODEX_PLUGINS_MARKETPLACE_NAME,
 		source: `${CODEX_PLUGINS_MARKETPLACE_NAME}/${pluginName}`,
-		sourceKind: "app-server",
 		migratable: true,
 		installed: plugin.installed,
 		enabled: plugin.enabled
@@ -1938,8 +1791,7 @@ function pluginNameFromSummary(summary) {
 		if (normalized) return normalized;
 	}
 }
-async function discoverCodexSource(inputOrOptions) {
-	const options = typeof inputOrOptions === "string" || inputOrOptions === void 0 ? { input: inputOrOptions } : inputOrOptions;
+async function discoverCodexSource(options = {}) {
 	const codexHome = resolveHomePath(options.input?.trim() || defaultCodexHome());
 	const codexSkillsDir = path.join(codexHome, "skills");
 	const agentsSkillsDir = personalAgentsSkillsDir();
@@ -1947,7 +1799,7 @@ async function discoverCodexSource(inputOrOptions) {
 	const authPath = path.join(codexHome, "auth.json");
 	const modelsCachePath = path.join(codexHome, "models_cache.json");
 	const hooksPath = path.join(codexHome, "hooks", "hooks.json");
-	const { memoriesDir, memoryFiles } = await discoverCodexMemorySources(codexHome);
+	const memoryFiles = await discoverCodexMemorySources(codexHome);
 	const codexSkills = options.memoryOnly ? [] : await discoverSkillDirs({
 		root: codexSkillsDir,
 		sourceLabel: "Codex skill",
@@ -1987,11 +1839,8 @@ async function discoverCodexSource(inputOrOptions) {
 		codexHome,
 		...await isDirectory(codexSkillsDir) ? { codexSkillsDir } : {},
 		...await isDirectory(agentsSkillsDir) ? { personalAgentsSkillsDir: agentsSkillsDir } : {},
-		...await exists(configPath) ? { configPath } : {},
 		...hasAuth ? { authPath } : {},
 		...await exists(modelsCachePath) ? { modelsCachePath } : {},
-		...await exists(hooksPath) ? { hooksPath } : {},
-		...memoriesDir ? { memoriesDir } : {},
 		memoryFiles,
 		skills,
 		plugins,
@@ -2040,12 +1889,98 @@ const CODEX_PLUGIN_NATIVE_CONFIG_PATH = [
 ];
 const MIGRATION_REASON_PLUGIN_EXISTS = "plugin exists";
 const CODEX_PLUGIN_SOURCE_APP_VERIFICATION_UNVERIFIED = "not_run";
-function uniquePluginConfigKey(plugin, counts, usedCounts) {
-	const base = sanitizeName(plugin.pluginName ?? plugin.name) || "codex-plugin";
+const MIGRATION_REASON_TARGET_NOT_REGULAR = "target is not a regular file";
+async function lstatIfExists(filePath) {
+	try {
+		return await fs.lstat(filePath);
+	} catch (error) {
+		const code = extractErrorCode(error);
+		if (code === "ENOENT" || code === "ENOTDIR") return;
+		throw error;
+	}
+}
+async function buildCodexMemoryItems(params) {
+	const items = [];
+	for (const memory of params.memoryFiles) {
+		const target = path.join(params.workspaceDir, "memory", "imports", "codex", path.basename(memory.path));
+		const targetStat = await lstatIfExists(target);
+		const targetNotRegular = targetStat !== void 0 && !targetStat.isFile();
+		if (!targetNotRegular) {
+			const [source, workspace, destination] = await Promise.all([
+				fs.realpath(path.dirname(memory.path)),
+				canonicalPathFromExistingAncestor(params.workspaceDir),
+				canonicalPathFromExistingAncestor(target)
+			]);
+			if (!isPathInside(workspace, destination)) throw new Error("Codex memory import destination must stay in the selected workspace.");
+			if (isPathInside(source, destination) || isPathInside(destination, source)) throw new Error("Codex memory source and OpenClaw import destination must be separate paths.");
+		}
+		const targetConflict = targetStat !== void 0 && !params.overwrite;
+		items.push(createMigrationItem({
+			id: memory.id,
+			kind: "memory",
+			action: "copy",
+			source: memory.path,
+			target,
+			status: targetNotRegular || targetConflict ? "conflict" : "planned",
+			reason: targetNotRegular ? MIGRATION_REASON_TARGET_NOT_REGULAR : targetConflict ? MIGRATION_REASON_TARGET_EXISTS : void 0,
+			message: "Copy consolidated Codex memory into the OpenClaw memory index.",
+			details: {
+				sourceType: "codex-memory",
+				sourceLabel: memory.label,
+				collectionId: "codex",
+				collectionLabel: "Codex",
+				relativePath: path.basename(memory.path)
+			}
+		}));
+	}
+	return items;
+}
+function uniqueSkillName(skill, counts) {
+	const base = sanitizeName(skill.name) || "codex-skill";
 	if ((counts.get(base) ?? 0) <= 1) return base;
-	const next = (usedCounts.get(base) ?? 0) + 1;
-	usedCounts.set(base, next);
-	return sanitizeName(`${base}-${next}`) || base;
+	return sanitizeName([
+		"codex",
+		sanitizeName(path.basename(path.dirname(skill.source))),
+		base
+	].filter(Boolean).join("-")) || base;
+}
+async function buildCodexSkillItems(params) {
+	const counts = /* @__PURE__ */ new Map();
+	for (const skill of params.skills) {
+		const base = sanitizeName(skill.name) || "codex-skill";
+		counts.set(base, (counts.get(base) ?? 0) + 1);
+	}
+	const planned = params.skills.map((skill) => {
+		const name = uniqueSkillName(skill, counts);
+		return {
+			skill,
+			name,
+			target: path.join(params.workspaceDir, "skills", name)
+		};
+	});
+	const resolvedCounts = planned.reduce((resolved, item) => {
+		resolved.set(item.name, (resolved.get(item.name) ?? 0) + 1);
+		return resolved;
+	}, /* @__PURE__ */ new Map());
+	return await Promise.all(planned.map(async (item) => {
+		const collision = (resolvedCounts.get(item.name) ?? 0) > 1;
+		const targetExists = await exists(item.target);
+		const conflict = collision || targetExists && !params.overwrite;
+		return createMigrationItem({
+			id: `skill:${item.name}`,
+			kind: "skill",
+			action: "copy",
+			source: item.skill.source,
+			target: item.target,
+			status: conflict ? "conflict" : "planned",
+			reason: collision ? `multiple Codex skills normalize to "${item.name}"` : conflict ? MIGRATION_REASON_TARGET_EXISTS : void 0,
+			message: `Copy ${item.skill.sourceLabel} into this OpenClaw agent workspace.`,
+			details: {
+				skillName: item.name,
+				sourceLabel: item.skill.sourceLabel
+			}
+		});
+	}));
 }
 function readExistingCodexPluginEntries(config) {
 	const entries = readMigrationConfigPath(config, [...CODEX_PLUGIN_NATIVE_CONFIG_PATH, "plugins"]);
@@ -2076,18 +2011,12 @@ function readExistingPluginAllowDestructiveActions(existing, pluginName) {
 	return normalized === "auto" || normalized === "ask" ? normalized : void 0;
 }
 function buildPluginItems(ctx, plugins) {
-	const baseCounts = /* @__PURE__ */ new Map();
-	for (const plugin of plugins.filter((entry) => entry.migratable)) {
-		const base = sanitizeName(plugin.pluginName ?? plugin.name) || "codex-plugin";
-		baseCounts.set(base, (baseCounts.get(base) ?? 0) + 1);
-	}
 	const existingPluginEntries = readExistingCodexPluginEntries(ctx.config);
-	const usedCounts = /* @__PURE__ */ new Map();
 	let manualIndex = 0;
 	const items = [];
 	for (const plugin of plugins) {
 		if (plugin.migratable && plugin.marketplaceName === "openai-curated" && plugin.pluginName) {
-			const configKey = uniquePluginConfigKey(plugin, baseCounts, usedCounts);
+			const configKey = plugin.pluginName;
 			const plannedEntry = {
 				enabled: true,
 				marketplaceName: CODEX_PLUGINS_MARKETPLACE_NAME,
@@ -2122,12 +2051,6 @@ function buildPluginItems(ctx, plugins) {
 		}
 		manualIndex += 1;
 		if (plugin.migrationBlock && plugin.pluginName) {
-			const details = {
-				pluginName: plugin.pluginName,
-				marketplaceName: CODEX_PLUGINS_MARKETPLACE_NAME,
-				...plugin.migrationBlock.apps ? { apps: plugin.migrationBlock.apps } : {},
-				...plugin.migrationBlock.error ? { error: plugin.migrationBlock.error } : {}
-			};
 			items.push(createMigrationItem({
 				id: `plugin:${sanitizeName(plugin.name) || sanitizeName(path.basename(plugin.source))}:${manualIndex}`,
 				kind: "manual",
@@ -2136,7 +2059,12 @@ function buildPluginItems(ctx, plugins) {
 				status: "skipped",
 				reason: plugin.migrationBlock.code,
 				message: plugin.message ?? `Codex native plugin "${plugin.name}" was found but not activated automatically.`,
-				details: { ...details }
+				details: {
+					pluginName: plugin.pluginName,
+					marketplaceName: CODEX_PLUGINS_MARKETPLACE_NAME,
+					...plugin.migrationBlock.apps ? { apps: plugin.migrationBlock.apps } : {},
+					...plugin.migrationBlock.error ? { error: plugin.migrationBlock.error } : {}
+				}
 			}));
 			continue;
 		}
@@ -2174,7 +2102,6 @@ function normalizeExistingAllowDestructiveActions(value) {
 	return asBoolean(value);
 }
 function readExistingPluginPolicyRepairs(config) {
-	if (config === void 0) return {};
 	return Object.fromEntries(Object.entries(readExistingCodexPluginEntries(config)).flatMap(([configKey, entry]) => {
 		const pluginEntry = isRecord(entry) ? entry : void 0;
 		if (pluginEntry?.allow_destructive_actions !== "on-request") return [];
@@ -2184,9 +2111,9 @@ function readExistingPluginPolicyRepairs(config) {
 		}]];
 	}));
 }
-function buildCodexPluginsConfigValue(entries, params = {}) {
+function buildCodexPluginsConfigValue(entries, config) {
 	const plugins = {
-		...readExistingPluginPolicyRepairs(params.config),
+		...readExistingPluginPolicyRepairs(config),
 		...Object.fromEntries(entries.toSorted((a, b) => a.configKey.localeCompare(b.configKey)).map((entry) => [entry.configKey, {
 			enabled: entry.enabled,
 			marketplaceName: CODEX_PLUGINS_MARKETPLACE_NAME,
@@ -2198,7 +2125,7 @@ function buildCodexPluginsConfigValue(entries, params = {}) {
 		enabled: true,
 		config: { codexPlugins: {
 			enabled: true,
-			allow_destructive_actions: params.config === void 0 ? true : readExistingAllowDestructiveActions(params.config) ?? true,
+			allow_destructive_actions: readExistingAllowDestructiveActions(config) ?? true,
 			plugins
 		} }
 	};
@@ -2225,7 +2152,7 @@ function hasCodexPluginConfigConflict(config, value) {
 function buildPluginConfigItem(ctx, pluginItems) {
 	const entries = pluginItems.filter((item) => item.status === "planned").map((item) => readCodexPluginMigrationConfigEntry(item, true)).filter((entry) => entry !== void 0);
 	if (entries.length === 0) return;
-	const value = buildCodexPluginsConfigValue(entries, { config: ctx.config });
+	const value = buildCodexPluginsConfigValue(entries, ctx.config);
 	const conflict = !ctx.overwrite && hasCodexPluginConfigConflict(ctx.config, value);
 	return createMigrationItem({
 		id: CODEX_PLUGIN_CONFIG_ITEM_ID,
@@ -2351,15 +2278,9 @@ async function applyCodexMigrationPlan(params) {
 	const targets = resolveCodexMigrationTargets(params.ctx);
 	const codexHome = typeof plan.metadata?.codexHome === "string" && plan.metadata.codexHome.trim() ? plan.metadata.codexHome : plan.source;
 	const authSource = {
-		root: plan.source,
-		confidence: "high",
 		codexHome,
 		authPath: path.join(codexHome, "auth.json"),
-		modelsCachePath: path.join(codexHome, "models_cache.json"),
-		memoryFiles: [],
-		skills: [],
-		plugins: [],
-		archivePaths: []
+		modelsCachePath: path.join(codexHome, "models_cache.json")
 	};
 	const runtime = withCachedMigrationConfigRuntime(params.ctx.runtime ?? params.runtime, params.ctx.config);
 	const applyCtx = {
@@ -2372,20 +2293,13 @@ async function applyCodexMigrationPlan(params) {
 			continue;
 		}
 		if (item.id === "config:codex-plugins") items.push(await applyCodexPluginConfigItem(applyCtx, item, items));
-		else if (item.kind === "auth") {
-			const authItem = await applyCodexAuthItem({
-				ctx: applyCtx,
-				item,
-				source: authSource,
-				targets
-			});
-			items.push(authItem);
-			items.push(...await buildCodexAuthConfigPatchItems({
-				ctx: applyCtx,
-				item: authItem,
-				source: authSource
-			}));
-		} else if (item.kind === "plugin" && item.action === "install") items.push(await applyCodexPluginInstallItem(applyCtx, item));
+		else if (item.kind === "auth") items.push(...await applyCodexAuthItems({
+			ctx: applyCtx,
+			item,
+			source: authSource,
+			targets
+		}));
+		else if (item.kind === "plugin" && item.action === "install") items.push(await applyCodexPluginInstallItem(applyCtx, item));
 		else if (item.kind === "manual") items.push(applyMigrationManualItem(item));
 		else if (item.action === "archive") items.push(await archiveMigrationItem(item, reportDir));
 		else if (item.kind === "memory") items.push(await copyMemoryMigrationFileItem(item, reportDir, {
@@ -2576,7 +2490,7 @@ async function applyCodexPluginConfigItem(ctx, item, appliedItems) {
 	const configApi = resolveMigrationConfigRuntime(ctx);
 	const currentConfig = returnPatch ? ctx.config : configApi?.current?.();
 	if (!currentConfig) return markMigrationItemError(item, "config runtime unavailable");
-	const value = buildCodexPluginsConfigValue(entries, { config: currentConfig });
+	const value = buildCodexPluginsConfigValue(entries, currentConfig);
 	if (!ctx.overwrite && hasCodexPluginConfigConflict(currentConfig, value)) return markMigrationItemConflict(item, MIGRATION_REASON_TARGET_EXISTS);
 	const migratedItem = {
 		...item,
@@ -2609,17 +2523,15 @@ function isCodexPluginConfigTerminal(item) {
 }
 function readAppliedPluginConfigEntry(item) {
 	if (item.status === "migrated" || item.deferredCompletion === true) return readCodexPluginMigrationConfigEntry(item, true);
-	if (item.status === "skipped" && item.reason !== CODEX_PLUGIN_NOT_SELECTED_REASON && item.reason === CODEX_PLUGIN_AUTH_REQUIRED_REASON) return readCodexPluginMigrationConfigEntry(item, false);
+	if (item.status === "skipped" && item.reason === CODEX_PLUGIN_AUTH_REQUIRED_REASON) return readCodexPluginMigrationConfigEntry(item, false);
 }
 function readCodexPluginPolicy(item) {
-	const configKey = item.details?.configKey;
-	const marketplaceName = item.details?.marketplaceName;
-	const pluginName = item.details?.pluginName;
-	if (typeof configKey !== "string" || marketplaceName !== "openai-curated" || typeof pluginName !== "string") return;
+	const entry = readCodexPluginMigrationConfigEntry(item, true);
+	if (!entry) return;
 	return {
-		configKey,
+		configKey: entry.configKey,
 		marketplaceName: CODEX_PLUGINS_MARKETPLACE_NAME,
-		pluginName,
+		pluginName: entry.pluginName,
 		enabled: true,
 		allowDestructiveActions: true,
 		destructiveApprovalMode: "allow"
@@ -2833,7 +2745,7 @@ function createCodexThreadsTool(options) {
 	return {
 		name: "codex_threads",
 		label: "Codex Threads",
-		description: "List and inspect native Codex threads. When supervision is enabled, raw transcript reads and every mutation require their matching supervision policy option.",
+		description: "Manage native Codex threads: list, read, fork, rename, archive (confirm:true), unarchive. When supervision is enabled, raw transcript reads and every mutation require their matching supervision policy option.",
 		parameters: CodexThreadsParamsSchema,
 		async execute(_toolCallId, rawParams) {
 			const params = asRecord$1(rawParams);
@@ -3758,7 +3670,7 @@ function createCodexSupervisionTools(options) {
 }
 //#endregion
 //#region extensions/codex/src/web-search-provider.ts
-const loadCodexWebSearchRuntime = createLazyRuntimeModule(() => import("./web-search-provider.runtime-Bx6HAc_k.js"));
+const loadCodexWebSearchRuntime = createLazyRuntimeModule(() => import("./web-search-provider.runtime-CaQMYDbp.js"));
 const CodexWebSearchSchema = {
 	type: "object",
 	properties: { query: {
@@ -3812,11 +3724,39 @@ var codex_default = definePluginEntry({
 				origin: "bundled",
 				config: normalizePluginsConfig(liveConfig.plugins),
 				rootConfig: liveConfig,
-				enabledByDefault: readCodexPluginConfig(livePluginConfig).supervision?.enabled === true
+				enabledByDefault: livePluginConfig !== void 0
 			}).enabled) return;
 			return livePluginConfig;
 		};
 		const resolveCurrentPluginConfig = () => resolvePluginConfig(resolveCurrentConfig);
+		if (api.registrationMode === "full") {
+			const realtimeBrowserSession = configureCodexRealtimeBrowserSession({
+				getConfig: resolveCurrentConfig,
+				getPluginConfig: resolveCurrentPluginConfig
+			});
+			api.registerHttpRoute({
+				path: CODEX_REALTIME_OFFER_PATH,
+				auth: "plugin",
+				match: "exact",
+				handler: realtimeBrowserSession.handler
+			});
+			api.registerService({
+				id: "codex-oauth-realtime-browser-session-warmup",
+				start: () => {
+					realtimeBrowserSession.warmup().catch((error) => {
+						api.logger.debug?.(`Codex OAuth realtime warmup unavailable: ${error instanceof Error ? error.message : String(error)}`);
+					});
+				}
+			});
+			api.lifecycle.registerRuntimeLifecycle({
+				id: "codex-oauth-realtime-browser-session",
+				description: "Release Codex OAuth realtime browser sessions when the plugin stops",
+				cleanup: async ({ reason }) => {
+					if (reason === "reset" || reason === "delete") return;
+					await realtimeBrowserSession.cleanup();
+				}
+			});
+		}
 		let bindingStateStore;
 		const openBindingStateStore = () => bindingStateStore ??= api.runtime.state.openSyncKeyedStore({
 			namespace: CODEX_APP_SERVER_BINDING_NAMESPACE,
@@ -3948,7 +3888,7 @@ var codex_default = definePluginEntry({
 			if (!previousSessionId || !sessionId || previousSessionId === sessionId) return;
 			const config = resolveCurrentConfig();
 			const sessionKey = ctx.sessionKey?.trim();
-			const { sessionBindingIdentity } = await import("./session-binding-ZSMX1omP.js").then((n) => n.u);
+			const { sessionBindingIdentity } = await import("./session-binding-DlVQ-Pxs.js").then((n) => n.u);
 			const identity = sessionBindingIdentity({
 				sessionId,
 				...sessionKey ? { sessionKey } : {},
@@ -3964,8 +3904,9 @@ var codex_default = definePluginEntry({
 			const endedSessionKey = sessionKey?.trim();
 			const nextSessionKey = event.nextSessionKey?.trim();
 			if (endedSessionKey && nextSessionKey && nextSessionKey !== endedSessionKey) return;
+			if (event.nextSessionId?.trim() === event.sessionId.trim()) return;
 			const config = resolveCurrentConfig();
-			const { sessionBindingIdentity } = await import("./session-binding-ZSMX1omP.js").then((n) => n.u);
+			const { sessionBindingIdentity } = await import("./session-binding-DlVQ-Pxs.js").then((n) => n.u);
 			await bindingStore.retireSessionGeneration(sessionBindingIdentity({
 				sessionId: event.sessionId,
 				...sessionKey ? { sessionKey } : {},