@openclaw/codex 2026.7.2-beta.4 → 2026.7.2-beta.7

package/dist/{compact-CC5KhBzX.js → compact-D_uvHurS.js}

@@ -1,10 +1,10 @@
-import { Q as isJsonObject, R as CodexAppServerRpcError, a as getLeasedSharedCodexAppServerClient, c as releaseLeasedSharedCodexAppServerClient } from "./shared-client-wmgNFNYp.js";
-import { _ as readCodexNotificationItem } from "./attempt-notifications-DdmnBMUp.js";
-import { l as sessionBindingIdentity, t as CODEX_APP_SERVER_BINDING_GUARDED_REQUEST_TIMEOUT_MS } from "./session-binding-ZSMX1omP.js";
-import { n as resolveCodexNativeExecutionBlock } from "./sandbox-guard-D1Wky__S.js";
-import { a as resolveCodexBindingAppServerConnection, n as readCodexNotificationThreadId, r as readCodexNotificationTurnId } from "./notification-correlation-BGLixv5_.js";
-import { resolveAgentDir, resolveDefaultAgentId } from "openclaw/plugin-sdk/agent-runtime";
+import { W as isJsonObject, a as getLeasedSharedCodexAppServerClient, l as releaseLeasedSharedCodexAppServerClient, v as CodexAppServerRpcError } from "./shared-client-DTbvH-XV.js";
+import { d as sessionBindingIdentity, t as CODEX_APP_SERVER_BINDING_GUARDED_REQUEST_TIMEOUT_MS } from "./session-binding-BXpo9ymA.js";
+import { _ as readCodexNotificationItem } from "./attempt-notifications-AP-a-Q5k.js";
+import { n as resolveCodexNativeExecutionBlock } from "./sandbox-guard-NuhpXmPB.js";
+import { a as resolveCodexBindingAppServerConnection, n as readCodexNotificationThreadId, r as readCodexNotificationTurnId } from "./notification-correlation-CU6_AnOb.js";
 import { embeddedAgentLog, resolveCompactionTimeoutMs } from "openclaw/plugin-sdk/agent-harness-runtime";
+import { resolveAgentDir as resolveAgentDir$1, resolveDefaultAgentId } from "openclaw/plugin-sdk/agent-runtime";
 //#region extensions/codex/src/app-server/compact.ts
 /**
 * Native Codex app-server compaction bridge for bound OpenClaw sessions.
@@ -353,7 +353,7 @@ async function compactCodexNativeThread(params, options) {
 			authProfileId: requestedAuthProfileId ?? binding.authProfileId,
 			pluginConfig: options.pluginConfig,
 			config,
-			agentDir: resolveAgentDir(config, agentId)
+			agentDir: resolveAgentDir$1(config, agentId)
 		});
 	} catch (error) {
 		return {
@@ -371,7 +371,7 @@ async function compactCodexNativeThread(params, options) {
 	const shouldReleaseDefaultLease = !options.clientFactory;
 	const clientFactory = options.clientFactory ?? getLeasedSharedCodexAppServerClient;
 	const runtimeAuthPlan = params.runtimeAuthPlan ?? params.runtimePlan?.auth;
-	const usesPreparedApiKey = !usesSupervisionConnection && runtimeAuthPlan?.modelRoute?.authRequirement === "api-key";
+	const usesPreparedApiKey = !usesSupervisionConnection && appServer.start.homeScope !== "user" && runtimeAuthPlan?.modelRoute?.authRequirement === "api-key";
 	const preparedApiKey = usesPreparedApiKey ? params.resolvedApiKey?.trim() : void 0;
 	if (usesPreparedApiKey && !preparedApiKey) return {
 		ok: false,

package/dist/{computer-use-Ip1-QGa-.js → computer-use-CYEc8U3w.js}

@@ -1,9 +1,91 @@
-import { E as resolveFirstExistingMacOSDesktopCodexBundledMarketplacePath, H as isCodexAppServerConnectionClosedError, U as isCodexAppServerIndeterminateRequestCancellationError, W as isCodexAppServerIndeterminateTransportError, a as getLeasedSharedCodexAppServerClient, c as releaseLeasedSharedCodexAppServerClient, h as acquireCodexNativeConfigFence, l as resolveCodexNativeConfigFenceKey } from "./shared-client-wmgNFNYp.js";
-import { w as resolveCodexComputerUseConfig, x as resolveCodexAppServerRuntimeOptions } from "./session-binding-ZSMX1omP.js";
-import { n as describeControlFailure } from "./capabilities-CLICvTxf.js";
-import { r as requestCodexAppServerJson } from "./request-BTccUTD3.js";
+import { C as isCodexAppServerIndeterminateRequestCancellationError, G as resolveFirstExistingMacOSDesktopCodexBundledMarketplacePath, S as isCodexAppServerConnectionClosedError, _ as acquireCodexNativeConfigFence, a as getLeasedSharedCodexAppServerClient, l as releaseLeasedSharedCodexAppServerClient, u as resolveCodexNativeConfigFenceKey, w as isCodexAppServerIndeterminateTransportError } from "./shared-client-DTbvH-XV.js";
+import { g as resolveCodexAppServerRuntimeOptions, v as resolveCodexComputerUseConfig } from "./session-binding-BXpo9ymA.js";
+import { n as describeControlFailure } from "./capabilities-BFDTVYr4.js";
+import { r as requestCodexAppServerJson } from "./request-qKh331yu.js";
 import { existsSync } from "node:fs";
 import { runExec } from "openclaw/plugin-sdk/process-runtime";
+//#region extensions/codex/src/app-server/computer-use-process-repair.ts
+const COMPUTER_USE_PROCESS_LIST_TIMEOUT_MS = 2e3;
+const COMPUTER_USE_PROCESS_LIST_MAX_BUFFER_BYTES = 5 * 1024 * 1024;
+function scopedRepairUnavailableStatus() {
+	return {
+		attempted: false,
+		killedPids: [],
+		warnings: ["Computer Use auto-repair skipped because no scoped Codex app-server process was available."],
+		message: "Computer Use stale child repair requires a scoped local app-server PID."
+	};
+}
+async function killStaleComputerUseMcpChildren(options = {}) {
+	if (process.platform !== "darwin") return {
+		attempted: true,
+		killedPids: [],
+		warnings: [`Computer Use stale child repair is currently macOS-only, not ${process.platform}.`],
+		message: "Computer Use stale child repair skipped on this platform."
+	};
+	if (!options.ancestorPid || !Number.isSafeInteger(options.ancestorPid) || options.ancestorPid <= 0) return scopedRepairUnavailableStatus();
+	let stdout;
+	try {
+		stdout = (await runExec("/bin/ps", ["-axo", "pid=,ppid=,command="], {
+			logOutput: false,
+			maxBuffer: COMPUTER_USE_PROCESS_LIST_MAX_BUFFER_BYTES,
+			timeoutMs: COMPUTER_USE_PROCESS_LIST_TIMEOUT_MS
+		})).stdout;
+	} catch (error) {
+		return {
+			attempted: true,
+			killedPids: [],
+			warnings: [`Could not list processes for Computer Use repair: ${describeControlFailure(error)}`],
+			message: "Computer Use stale child repair could not inspect running processes."
+		};
+	}
+	const killedPids = [];
+	const warnings = [];
+	const processInfos = parsePsOutput(stdout);
+	for (const processInfo of processInfos) {
+		if (!isStaleComputerUseMcpChild(processInfo.command)) continue;
+		if (!isDescendantOfPid(processInfo.pid, options.ancestorPid, processInfos)) continue;
+		try {
+			process.kill(processInfo.pid, "SIGTERM");
+			killedPids.push(processInfo.pid);
+		} catch (error) {
+			warnings.push(`Could not terminate stale Computer Use MCP child pid ${processInfo.pid}: ${describeControlFailure(error)}`);
+		}
+	}
+	return {
+		attempted: true,
+		killedPids,
+		warnings,
+		message: killedPids.length === 0 ? "No stale Computer Use MCP children were found under the scoped Codex app-server process." : `Terminated ${killedPids.length} stale Computer Use MCP child process${killedPids.length === 1 ? "" : "es"} under the scoped Codex app-server process.`
+	};
+}
+function parsePsOutput(stdout) {
+	return stdout.split(/\r?\n/u).flatMap((line) => {
+		const match = /^\s*(\d+)\s+(\d+)\s+(.+)$/u.exec(line);
+		if (!match) return [];
+		return [{
+			pid: Number(match[1]),
+			ppid: Number(match[2]),
+			command: match[3] ?? ""
+		}];
+	}).filter((processInfo) => Number.isSafeInteger(processInfo.pid) && processInfo.pid > 0 && Number.isSafeInteger(processInfo.ppid) && processInfo.ppid >= 0);
+}
+function isStaleComputerUseMcpChild(command) {
+	return command.includes("SkyComputerUseClient") && /(?:^|\s)mcp(?:\s|$)/u.test(command);
+}
+function isDescendantOfPid(pid, ancestorPid, processInfos) {
+	const parents = new Map(processInfos.map((processInfo) => [processInfo.pid, processInfo.ppid]));
+	const seen = /* @__PURE__ */ new Set();
+	let current = pid;
+	while (!seen.has(current)) {
+		seen.add(current);
+		const parent = parents.get(current);
+		if (!parent || parent <= 0) return false;
+		if (parent === ancestorPid) return true;
+		current = parent;
+	}
+	return false;
+}
+//#endregion
 //#region extensions/codex/src/app-server/computer-use.ts
 /**
 * Computer Use plugin/MCP readiness checks and optional install flow for Codex
@@ -20,6 +102,8 @@ const CURATED_MARKETPLACE_POLL_INTERVAL_MS = 2e3;
 const COMPUTER_USE_MARKETPLACE_NAME_PRIORITY = [
 	"openai-bundled",
 	"openai-curated",
+	"openai-api-curated",
+	"openai-curated-remote",
 	"local"
 ];
 const COMPUTER_USE_LIVE_TEST_RETRY_COUNT = 1;
@@ -113,6 +197,7 @@ async function inspectCodexComputerUse(params) {
 			if (!runtime) throw new Error("Computer Use install could not resolve its app-server runtime");
 			client = await getLeasedSharedCodexAppServerClient({
 				startOptions: runtime.start,
+				pluginConfig: params.pluginConfig,
 				timeoutMs: params.timeoutMs ?? runtime.requestTimeoutMs,
 				config: params.config,
 				agentDir: params.agentDir,
@@ -178,18 +263,8 @@ async function ensureComputerUsePlugin(params) {
 				config: params.config,
 				plugin,
 				tools: [],
-				reason: pluginSetupReason(plugin, params.marketplace),
-				message: pluginSetupMessage(params.config, plugin, params.marketplace)
-			})
-		};
-		if (params.marketplace.kind === "remote") return {
-			ok: false,
-			status: statusFromPlugin({
-				config: params.config,
-				plugin,
-				tools: [],
-				reason: "remote_install_unsupported",
-				message: remoteInstallUnsupportedMessage(plugin, params.marketplace)
+				reason: pluginSetupReason(plugin),
+				message: pluginSetupMessage(params.config, plugin)
 			})
 		};
 		await params.request("plugin/install", pluginRequestParams(params.marketplace, params.config.pluginName));
@@ -202,8 +277,8 @@ async function ensureComputerUsePlugin(params) {
 			config: params.config,
 			plugin,
 			tools: [],
-			reason: pluginSetupReason(plugin, params.marketplace),
-			message: pluginSetupMessage(params.config, plugin, params.marketplace)
+			reason: pluginSetupReason(plugin),
+			message: pluginSetupMessage(params.config, plugin)
 		})
 	};
 	return {
@@ -213,9 +288,11 @@ async function ensureComputerUsePlugin(params) {
 }
 async function readComputerUseTools(params) {
 	let server = await readMcpServerStatus(params.request, params.config.mcpServerName);
-	if (!server && params.installPlugin) {
+	let tools = Object.keys(server?.tools ?? {}).toSorted();
+	if ((!server || tools.length === 0) && params.installPlugin) {
 		await reloadMcpServers(params.request);
 		server = await readMcpServerStatus(params.request, params.config.mcpServerName);
+		tools = Object.keys(server?.tools ?? {}).toSorted();
 	}
 	if (!server) return statusFromPlugin({
 		config: params.config,
@@ -224,10 +301,17 @@ async function readComputerUseTools(params) {
 		reason: "mcp_missing",
 		message: `Computer Use is installed, but the ${params.config.mcpServerName} MCP server is not available.`
 	});
+	if (tools.length === 0) return statusFromPlugin({
+		config: params.config,
+		plugin: params.plugin,
+		tools,
+		reason: "mcp_missing",
+		message: `Computer Use is installed, but the ${params.config.mcpServerName} MCP server exposes no tools.`
+	});
 	const status = statusFromPlugin({
 		config: params.config,
 		plugin: params.plugin,
-		tools: Object.keys(server.tools).toSorted(),
+		tools,
 		reason: "ready",
 		message: "Computer Use is ready."
 	});
@@ -316,14 +400,6 @@ async function runCodexComputerUseLiveTest(params) {
 async function cleanupComputerUseProbeThread(request, threadId, config) {
 	await Promise.allSettled([request("thread/unsubscribe", { threadId }, { timeoutMs: config.liveTestTimeoutMs }), request("thread/archive", { threadId }, { timeoutMs: config.liveTestTimeoutMs })]);
 }
-function scopedRepairUnavailableStatus() {
-	return {
-		attempted: false,
-		killedPids: [],
-		warnings: ["Computer Use auto-repair skipped because no scoped Codex app-server process was available."],
-		message: "Computer Use stale child repair requires a scoped local app-server PID."
-	};
-}
 async function resolveMarketplaceRef(params) {
 	let preferredMarketplaceName = params.config.marketplaceName;
 	if (params.config.marketplaceSource && params.allowAdd) {
@@ -380,17 +456,22 @@ function resolveBundledComputerUseMarketplacePath(params) {
 	return resolveFirstExistingMacOSDesktopCodexBundledMarketplacePath({ candidates: params.defaultBundledMarketplacePathCandidates });
 }
 function findComputerUseMarketplaces(listed, pluginName) {
-	return listed.marketplaces.filter((marketplace) => marketplace.plugins.some((plugin) => plugin.name === pluginName || plugin.id === pluginName || plugin.id === `${pluginName}@${marketplace.name}`)).map((marketplace) => {
-		if (marketplace.path) return {
+	return listed.marketplaces.flatMap((marketplace) => {
+		const plugin = marketplace.plugins.find((candidate) => candidate.name === pluginName || candidate.id === pluginName || candidate.id === `${pluginName}@${marketplace.name}`);
+		if (!plugin) return [];
+		if (marketplace.path) return [{
 			kind: "local",
 			name: marketplace.name,
 			path: marketplace.path
-		};
-		return {
+		}];
+		const remotePluginId = plugin.remotePluginId?.trim();
+		if (!remotePluginId) return [];
+		return [{
 			kind: "remote",
 			name: marketplace.name,
-			remoteMarketplaceName: marketplace.name
-		};
+			remoteMarketplaceName: marketplace.name,
+			remotePluginId
+		}];
 	});
 }
 function chooseKnownComputerUseMarketplace(candidates) {
@@ -442,25 +523,21 @@ async function reloadMcpServers(request) {
 	await request("config/mcpServer/reload", void 0);
 }
 function pluginRequestParams(marketplace, pluginName) {
-	return {
-		...marketplace.kind === "local" ? { marketplacePath: marketplace.path } : {},
-		...marketplace.kind === "remote" ? { remoteMarketplaceName: marketplace.remoteMarketplaceName } : {},
+	return marketplace.kind === "local" ? {
+		marketplacePath: marketplace.path,
 		pluginName
+	} : {
+		remoteMarketplaceName: marketplace.remoteMarketplaceName,
+		pluginName: marketplace.remotePluginId
 	};
 }
-function pluginSetupReason(plugin, marketplace) {
-	if (marketplace.kind === "remote") return "remote_install_unsupported";
+function pluginSetupReason(plugin) {
 	return plugin.summary.installed ? "plugin_disabled" : "plugin_not_installed";
 }
-function pluginSetupMessage(config, plugin, marketplace) {
-	if (marketplace.kind === "remote") return remoteInstallUnsupportedMessage(plugin, marketplace);
+function pluginSetupMessage(config, plugin) {
 	if (!plugin.summary.installed) return "Computer Use is available but not installed. Run /codex computer-use install or enable computerUse.autoInstall.";
 	return `Computer Use is installed, but the ${config.pluginName} plugin is disabled. Run /codex computer-use install or enable computerUse.autoInstall to re-enable it.`;
 }
-function remoteInstallUnsupportedMessage(plugin, marketplace) {
-	const marketplaceName = marketplace.name ?? plugin.marketplaceName;
-	return `Computer Use is ${plugin.summary.installed ? "installed but disabled" : "available"} in remote Codex marketplace ${marketplaceName}, but Codex app-server does not support remote plugin install yet. Configure computerUse.marketplaceSource or computerUse.marketplacePath for a local marketplace, then run /codex computer-use install.`;
-}
 function statusFromPlugin(params) {
 	return {
 		enabled: true,
@@ -582,75 +659,6 @@ function pluginWarnings(plugin) {
 	if (source && typeof source === "object" && "type" in source && source.type === "remote") warnings.push("Computer Use plugin is resolved from a remote marketplace; live local bundles are preferred.");
 	return warnings;
 }
-async function killStaleComputerUseMcpChildren(options = {}) {
-	if (process.platform !== "darwin") return {
-		attempted: true,
-		killedPids: [],
-		warnings: [`Computer Use stale child repair is currently macOS-only, not ${process.platform}.`],
-		message: "Computer Use stale child repair skipped on this platform."
-	};
-	if (!options.ancestorPid || !Number.isSafeInteger(options.ancestorPid) || options.ancestorPid <= 0) return scopedRepairUnavailableStatus();
-	let stdout;
-	try {
-		stdout = (await runExec("/bin/ps", ["-axo", "pid=,ppid=,command="], {
-			logOutput: false,
-			maxBuffer: 5 * 1024 * 1024
-		})).stdout;
-	} catch (error) {
-		return {
-			attempted: true,
-			killedPids: [],
-			warnings: [`Could not list processes for Computer Use repair: ${describeControlFailure(error)}`],
-			message: "Computer Use stale child repair could not inspect running processes."
-		};
-	}
-	const killedPids = [];
-	const warnings = [];
-	const processInfos = parsePsOutput(stdout);
-	for (const processInfo of processInfos) {
-		if (!isStaleComputerUseMcpChild(processInfo.command)) continue;
-		if (!isDescendantOfPid(processInfo.pid, options.ancestorPid, processInfos)) continue;
-		try {
-			process.kill(processInfo.pid, "SIGTERM");
-			killedPids.push(processInfo.pid);
-		} catch (error) {
-			warnings.push(`Could not terminate stale Computer Use MCP child pid ${processInfo.pid}: ${describeControlFailure(error)}`);
-		}
-	}
-	return {
-		attempted: true,
-		killedPids,
-		warnings,
-		message: killedPids.length === 0 ? "No stale Computer Use MCP children were found under the scoped Codex app-server process." : `Terminated ${killedPids.length} stale Computer Use MCP child process${killedPids.length === 1 ? "" : "es"} under the scoped Codex app-server process.`
-	};
-}
-function parsePsOutput(stdout) {
-	return stdout.split(/\r?\n/u).flatMap((line) => {
-		const match = /^\s*(\d+)\s+(\d+)\s+(.+)$/u.exec(line);
-		if (!match) return [];
-		return [{
-			pid: Number(match[1]),
-			ppid: Number(match[2]),
-			command: match[3] ?? ""
-		}];
-	}).filter((processInfo) => Number.isSafeInteger(processInfo.pid) && processInfo.pid > 0 && Number.isSafeInteger(processInfo.ppid) && processInfo.ppid >= 0);
-}
-function isStaleComputerUseMcpChild(command) {
-	return command.includes("SkyComputerUseClient") && /(?:^|\s)mcp(?:\s|$)/u.test(command);
-}
-function isDescendantOfPid(pid, ancestorPid, processInfos) {
-	const parents = new Map(processInfos.map((processInfo) => [processInfo.pid, processInfo.ppid]));
-	const seen = /* @__PURE__ */ new Set();
-	let current = pid;
-	while (!seen.has(current)) {
-		seen.add(current);
-		const parent = parents.get(current);
-		if (!parent || parent <= 0) return false;
-		if (parent === ancestorPid) return true;
-		current = parent;
-	}
-	return false;
-}
 function createComputerUseRequest(params) {
 	if (params.request) return params.request;
 	if (params.client) return async (method, requestParams, options) => await params.client.request(method, requestParams, {
@@ -682,4 +690,4 @@ function resolveComputerUseConfig(params) {
 	});
 }
 //#endregion
-export { runCodexComputerUseLiveTest as a, readCodexComputerUseStatus as i, installCodexComputerUse as n, killStaleComputerUseMcpChildren as r, ensureCodexComputerUse as t };
+export { killStaleComputerUseMcpChildren as a, runCodexComputerUseLiveTest as i, installCodexComputerUse as n, readCodexComputerUseStatus as r, ensureCodexComputerUse as t };

package/dist/{conversation-control-sNPsbTCP.js → conversation-control-xsIeXbo4.js}

@@ -1,9 +1,9 @@
-import { a as getLeasedSharedCodexAppServerClient, c as releaseLeasedSharedCodexAppServerClient, p as withLeasedCodexAppServerClientStartSelectionRetry, s as releaseCodexAppServerClientLease } from "./shared-client-wmgNFNYp.js";
-import { T as resolveCodexModelBackedReviewerPolicyContext, o as isCodexAppServerNativeAuthProfile, r as bindingStoreKey, s as normalizeCodexAppServerBindingModelProvider, v as isCodexFastServiceTier, x as resolveCodexAppServerRuntimeOptions } from "./session-binding-ZSMX1omP.js";
-import { x as resolveCodexBindingModelProviderFallback, y as resolveCodexAppServerRequestModelSelection } from "./thread-lifecycle-cqrOlJkq.js";
-import { t as CODEX_CONTROL_METHODS } from "./capabilities-CLICvTxf.js";
-import { r as formatCodexDisplayText } from "./command-formatters-DgADqnHa.js";
-import { a as resolveCodexBindingAppServerConnection } from "./notification-correlation-BGLixv5_.js";
+import { a as getLeasedSharedCodexAppServerClient, c as releaseCodexAppServerClientLease, h as withLeasedCodexAppServerClientStartSelectionRetry, l as releaseLeasedSharedCodexAppServerClient } from "./shared-client-DTbvH-XV.js";
+import { T as resolveCodexModelBackedReviewerPolicyContext, g as resolveCodexAppServerRuntimeOptions, j as isCodexFastServiceTier, o as isCodexAppServerNativeAuthProfile, r as bindingStoreKey, s as normalizeCodexAppServerBindingModelProvider } from "./session-binding-BXpo9ymA.js";
+import { S as resolveCodexBindingModelProviderFallback, b as resolveCodexAppServerRequestModelSelection } from "./thread-lifecycle-DF53ogiA.js";
+import { t as CODEX_CONTROL_METHODS } from "./capabilities-BFDTVYr4.js";
+import { r as formatCodexDisplayText } from "./command-formatters-C336eRVS.js";
+import { a as resolveCodexBindingAppServerConnection } from "./notification-correlation-CU6_AnOb.js";
 import { ModelSelectionLockedError } from "openclaw/plugin-sdk/model-session-runtime";
 //#region extensions/codex/src/command-authorization.ts
 const CODEX_NATIVE_EXECUTION_AUTH_ERROR = "Only an owner or operator.admin can control Codex native execution.";

package/dist/doctor-contract-api.js

@@ -3,37 +3,11 @@ import fs from "node:fs/promises";
 import path from "node:path";
 import { listAgentIds, resolveAgentDir, resolveSessionAgentIds } from "openclaw/plugin-sdk/agent-runtime";
 import { isDeepStrictEqual } from "node:util";
+import { isRecord } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { patchSessionEntry, resolveStorePath } from "openclaw/plugin-sdk/session-store-runtime";
+import { canonicalPathFromExistingAncestor, isPathInside, pathExists } from "openclaw/plugin-sdk/security-runtime";
 import { withFileLock } from "openclaw/plugin-sdk/file-lock";
-//#region extensions/codex/src/migration/session-binding-sidecar-archive.ts
-async function pathExists$1(filePath) {
-	try {
-		await fs.access(filePath);
-		return true;
-	} catch {
-		return false;
-	}
-}
-async function firstFreeArchivePath(sourcePath) {
-	for (let index = 2;; index++) {
-		const candidate = `${sourcePath}.migrated.${index}`;
-		if (!await pathExists$1(candidate)) return candidate;
-	}
-}
-async function archiveBindingSidecar(sourcePath) {
-	const archivePath = `${sourcePath}.migrated`;
-	if (!await pathExists$1(archivePath)) {
-		await fs.rename(sourcePath, archivePath);
-		return;
-	}
-	const [sourceBytes, archiveBytes] = await Promise.all([fs.readFile(sourcePath), fs.readFile(archivePath)]);
-	if (sourceBytes.equals(archiveBytes)) {
-		await fs.rm(sourcePath, { force: true });
-		return;
-	}
-	await fs.rename(sourcePath, await firstFreeArchivePath(sourcePath));
-}
-//#endregion
+import { archiveLegacyStateSource, legacyStateFileExists } from "openclaw/plugin-sdk/runtime-doctor";
 //#region extensions/codex/src/migration/session-binding-sidecars.ts
 const LEGACY_BINDING_SUFFIX = ".codex-app-server.json";
 const CODEX_AGENT_HARNESS_ID = "codex";
@@ -49,9 +23,9 @@ const LEGACY_BINDING_LOCK_OPTIONS = {
 };
 async function collectSessionSurfaces(params) {
 	const surfaces = /* @__PURE__ */ new Map();
-	const stateRoot = await canonicalizePath(params.stateDir);
+	const stateRoot = await canonicalPathFromExistingAncestor(params.stateDir);
 	const add = async (root, storePath, agentId, scan) => {
-		const canonicalRoot = await canonicalizePath(root);
+		const canonicalRoot = await canonicalPathFromExistingAncestor(root);
 		const surface = surfaces.get(canonicalRoot) ?? {
 			root: canonicalRoot,
 			scan: false,
@@ -81,7 +55,7 @@ async function collectSessionSurfaces(params) {
 			env: params.env
 		});
 		const root = path.dirname(storePath);
-		await add(root, storePath, agentId, isPathWithin(stateRoot, await canonicalizePath(root)));
+		await add(root, storePath, agentId, isPathInside(stateRoot, await canonicalPathFromExistingAncestor(root)));
 	}
 	const legacyRoot = path.join(params.stateDir, "sessions");
 	const defaultAgentId = resolveSessionAgentIds({ config: params.config }).defaultAgentId;
@@ -92,7 +66,7 @@ async function collectLegacyBindingSources(params, options = {}) {
 	const surfaces = await collectSessionSurfaces(params);
 	const sources = /* @__PURE__ */ new Map();
 	const addSource = async (sidecarPath, surface) => {
-		const canonicalSidecar = await canonicalizePath(sidecarPath);
+		const canonicalSidecar = await canonicalPathFromExistingAncestor(sidecarPath);
 		const source = sources.get(canonicalSidecar) ?? {
 			sidecarPath: canonicalSidecar,
 			transcriptPath: sidecarPath.slice(0, -22),
@@ -167,7 +141,7 @@ async function* iterateIndexedSidecars(surface) {
 				continue;
 			}
 			const sidecarPath = `${transcriptPath}${LEGACY_BINDING_SUFFIX}`;
-			if (await isRegularFile(sidecarPath)) yield sidecarPath;
+			if (await legacyStateFileExists(sidecarPath)) yield sidecarPath;
 		}
 	}
 }
@@ -190,7 +164,7 @@ async function* walkSidecars(root) {
 	}
 }
 async function collectBindingOwners(sources, surfaces, params) {
-	const sourcePaths = new Set(await Promise.all(sources.map((source) => canonicalizePath(source.transcriptPath))));
+	const sourcePaths = new Set(await Promise.all(sources.map((source) => canonicalPathFromExistingAncestor(source.transcriptPath))));
 	const owners = /* @__PURE__ */ new Map();
 	const storePaths = new Set(surfaces.flatMap((surface) => [...surface.storePaths]));
 	const storeAgentIds = /* @__PURE__ */ new Map();
@@ -201,7 +175,7 @@ async function collectBindingOwners(sources, surfaces, params) {
 	}
 	const failures = [];
 	for (const storePath of storePaths) {
-		const canonicalStorePath = await canonicalizePath(storePath);
+		const canonicalStorePath = await canonicalPathFromExistingAncestor(storePath);
 		const index = await readLegacySessionIndex(storePath);
 		if ("failure" in index) {
 			failures.push(index.failure);
@@ -219,7 +193,7 @@ async function collectBindingOwners(sources, surfaces, params) {
 			let canonicalLegacyTranscriptPath;
 			try {
 				legacyTranscriptPath = await resolveLegacySessionFileLocator(sessionsDir, entry, sessionId);
-				canonicalLegacyTranscriptPath = await canonicalizePath(legacyTranscriptPath);
+				canonicalLegacyTranscriptPath = await canonicalPathFromExistingAncestor(legacyTranscriptPath);
 			} catch {
 				failures.push(`session index ${storePath} has an invalid locator for ${sessionKey}`);
 				continue;
@@ -256,8 +230,8 @@ async function resolveLegacySessionFileLocator(sessionsDir, entry, sessionId) {
 	const sessionFile = entry.sessionFile?.trim();
 	if (!sessionFile) return fallback;
 	const candidate = path.resolve(base, sessionFile);
-	const [canonicalBase, canonicalCandidate] = await Promise.all([canonicalizePathForContainment(base), canonicalizePathForContainment(candidate)]);
-	if (!isPathWithin(canonicalBase, canonicalCandidate)) throw new Error("legacy session file locator escapes its session directory");
+	const [canonicalBase, canonicalCandidate] = await Promise.all([canonicalPathFromExistingAncestor(base), canonicalPathFromExistingAncestor(candidate)]);
+	if (!isPathInside(canonicalBase, canonicalCandidate)) throw new Error("legacy session file locator escapes its session directory");
 	return candidate;
 }
 function resolveLegacyBindingOwnerAgentId(params) {
@@ -302,7 +276,7 @@ async function migrateSource(source, candidates, params, store) {
 		return await withFileLock(source.sidecarPath, LEGACY_BINDING_LOCK_OPTIONS, async () => {
 			const [contents, stat] = await Promise.all([fs.readFile(source.sidecarPath, "utf8"), fs.stat(source.sidecarPath)]);
 			const raw = JSON.parse(contents);
-			const [{ bindingStoreKey, createStoredCodexAppServerBinding, normalizeStoredCodexAppServerBindingFingerprints, readStoredCodexAppServerBinding }, { legacyCodexConversationBindingId }] = await Promise.all([import("./session-binding-ZSMX1omP.js").then((n) => n.u), import("./conversation-binding-data-BHRpYbX3.js").then((n) => n.t)]);
+			const [{ bindingStoreKey, createStoredCodexAppServerBinding, normalizeStoredCodexAppServerBindingFingerprints, readStoredCodexAppServerBinding }, { legacyCodexConversationBindingId }] = await Promise.all([import("./session-binding-BXpo9ymA.js").then((n) => n.f), import("./conversation-binding-data-BHRpYbX3.js").then((n) => n.t)]);
 			const agentId = owner?.agentId ?? (source.agentIds.size === 1 ? [...source.agentIds][0] : void 0);
 			const baseStored = createStoredCodexAppServerBinding(raw, {
 				now: stat.mtime.toISOString(),
@@ -402,7 +376,14 @@ async function migrateSource(source, candidates, params, store) {
 				}
 				for (const entry of entries) if (!hasExpected(await store.lookup(entry.key), entry.value)) return retain(`canonical plugin state changed at ${entry.key}`);
 			}
-			await archiveBindingSidecar(source.sidecarPath);
+			const archiveWarnings = [];
+			await archiveLegacyStateSource({
+				filePath: source.sidecarPath,
+				label: "Codex app-server binding",
+				changes: [],
+				warnings: archiveWarnings
+			});
+			if (archiveWarnings.length > 0 && await pathExists(source.sidecarPath)) return retain(archiveWarnings.join("; "));
 			return {
 				archived: true,
 				importedKeys
@@ -427,7 +408,7 @@ async function recordSessionOwner(owner, env) {
 	} catch {
 		return "its session owner changed before Codex ownership could be recorded";
 	}
-	if (await canonicalizePath(currentTranscriptPath) !== await canonicalizePath(owner.transcriptPath) || currentOwner.entry.lifecycleRevision !== owner.lifecycleRevision) return "its session owner changed before Codex ownership could be recorded";
+	if (await canonicalPathFromExistingAncestor(currentTranscriptPath) !== await canonicalPathFromExistingAncestor(owner.transcriptPath) || currentOwner.entry.lifecycleRevision !== owner.lifecycleRevision) return "its session owner changed before Codex ownership could be recorded";
 	const legacyHarnessId = currentOwner.entry.agentHarnessId?.trim();
 	if (currentOwner.entry.agentHarnessId !== void 0 && !legacyHarnessId) return "its session owner changed before Codex ownership could be recorded";
 	if (legacyHarnessId && legacyHarnessId !== CODEX_AGENT_HARNESS_ID) return `its session is owned by agent harness ${legacyHarnessId}`;
@@ -474,54 +455,11 @@ async function readDirectoryEntries(directory) {
 		throw error;
 	}
 }
-async function isRegularFile(filePath) {
-	try {
-		return (await fs.stat(filePath)).isFile();
-	} catch {
-		return false;
-	}
-}
-function isRecord(value) {
-	return value !== null && typeof value === "object" && !Array.isArray(value);
-}
 function isSafeLegacySessionId(value) {
 	if (typeof value !== "string") return false;
 	const trimmed = value.trim();
 	return trimmed.length > 0 && trimmed.length <= 255 && /^[A-Za-z0-9][A-Za-z0-9._:@-]*$/.test(trimmed);
 }
-function isPathWithin(root, candidate) {
-	const relative = path.relative(root, candidate);
-	return relative === "" || relative !== ".." && !relative.startsWith(`..${path.sep}`) && !path.isAbsolute(relative);
-}
-async function canonicalizePath(filePath) {
-	try {
-		return await fs.realpath(filePath);
-	} catch {
-		return path.resolve(filePath);
-	}
-}
-async function canonicalizePathForContainment(filePath) {
-	const resolved = path.resolve(filePath);
-	const suffix = [];
-	let probe = resolved;
-	while (true) try {
-		const realProbe = await fs.realpath(probe);
-		return suffix.length === 0 ? realProbe : path.join(realProbe, ...suffix.toReversed());
-	} catch {
-		const parent = path.dirname(probe);
-		if (parent === probe) return resolved;
-		suffix.push(path.basename(probe));
-		probe = parent;
-	}
-}
-async function pathExists(filePath) {
-	try {
-		await fs.access(filePath);
-		return true;
-	} catch {
-		return false;
-	}
-}
 const stateMigrations = [{
 	id: "codex-app-server-sidecars-to-plugin-state",
 	label: "Codex app-server thread bindings",
@@ -554,7 +492,7 @@ const stateMigrations = [{
 		let migrated = 0;
 		let partialImports = 0;
 		for (const source of sources) {
-			const result = await migrateSource(source, ownerCollection.owners.get(await canonicalizePath(source.transcriptPath)) ?? [], params, store);
+			const result = await migrateSource(source, ownerCollection.owners.get(await canonicalPathFromExistingAncestor(source.transcriptPath)) ?? [], params, store);
 			if (result.warning) warnings.push(result.warning);
 			if (result.notice) notices.push(result.notice);
 			if (result.archived) migrated++;