@openclaw/codex 2026.7.2-beta.4 → 2026.7.2-beta.7

package/dist/index.js

@@ -1,22 +1,22 @@
 import { registerCodexCliMetadata } from "./cli-metadata.js";
 import { createCodexAppServerAgentHarness } from "./harness.js";
-import { C as resolveCodexAppServerFallbackApiKeyCacheKey, Q as isJsonObject, S as resolveCodexAppServerAuthProfileIdForAgent, Y as CODEX_INTERACTIVE_THREAD_SOURCE_KINDS, a as getLeasedSharedCodexAppServerClient, b as resolveCodexAppServerAuthAccountCacheKey, c as releaseLeasedSharedCodexAppServerClient, p as withLeasedCodexAppServerClientStartSelectionRetry, r as clearSharedCodexAppServerClientIfCurrentAndWait, s as releaseCodexAppServerClientLease } from "./shared-client-wmgNFNYp.js";
-import { D as resolveCodexSupervisionAppServerRuntimeOptions, O as resolveOpenClawExecPolicyForCodexAppServer, b as readCodexPluginConfig, d as CODEX_PLUGINS_MARKETPLACE_NAME, g as codexSandboxPolicyForTurn, h as codexAppServerStartOptionsKey, l as sessionBindingIdentity, m as canUseCodexModelBackedApprovalsReviewerForModel, n as assertCodexBindingMayBeReplaced, o as isCodexAppServerNativeAuthProfile, p as assertCodexAppServerConnectionSecurity, s as normalizeCodexAppServerBindingModelProvider, x as resolveCodexAppServerRuntimeOptions } from "./session-binding-ZSMX1omP.js";
-import { N as CODEX_APP_SERVER_UNSUBSCRIBE_TIMEOUT_MS, R as unsubscribeCodexThreadBestEffort, _ as CODEX_NATIVE_PERSONALITY_NONE, c as resumeCodexAppServerThread, et as ensureCodexPluginActivation, tt as pluginReadParams, y as resolveCodexAppServerRequestModelSelection } from "./thread-lifecycle-cqrOlJkq.js";
-import { _ as assertCodexThreadStartResponse } from "./transcript-mirror-2p7kl6e4.js";
-import { i as defaultCodexAppInventoryCache, r as buildCodexPluginAppCacheKey } from "./plugin-app-cache-key-CvzvmBRz.js";
+import { I as resolveCodexAppServerAuthProfileIdForAgent, L as resolveCodexAppServerFallbackApiKeyCacheKey, P as resolveCodexAppServerAuthAccountCacheKey, V as CODEX_INTERACTIVE_THREAD_SOURCE_KINDS, W as isJsonObject, a as getLeasedSharedCodexAppServerClient, c as releaseCodexAppServerClientLease, h as withLeasedCodexAppServerClientStartSelectionRetry, l as releaseLeasedSharedCodexAppServerClient, r as clearSharedCodexAppServerClientIfCurrentAndWait } from "./shared-client-DTbvH-XV.js";
+import { A as resolveOpenClawExecPolicyForCodexAppServer, C as canUseCodexModelBackedApprovalsReviewerForModel, M as CODEX_PLUGINS_MARKETPLACE_NAME, O as readCodexPluginConfig, b as assertCodexAppServerConnectionSecurity, d as sessionBindingIdentity, g as resolveCodexAppServerRuntimeOptions, m as codexSandboxPolicyForTurn, n as assertCodexBindingMayBeReplaced, o as isCodexAppServerNativeAuthProfile, p as codexAppServerStartOptionsKey, s as normalizeCodexAppServerBindingModelProvider, y as resolveCodexSupervisionAppServerRuntimeOptions } from "./session-binding-BXpo9ymA.js";
 import { n as CODEX_APP_SERVER_BINDING_NAMESPACE, t as CODEX_APP_SERVER_BINDING_MAX_ENTRIES } from "./session-binding-meta-B7aEMU7g.js";
+import { J as isOpenAiCuratedMarketplace, Y as pluginReadParams, _t as unsubscribeCodexThreadBestEffort, b as resolveCodexAppServerRequestModelSelection, dt as CODEX_APP_SERVER_UNSUBSCRIBE_TIMEOUT_MS, l as resumeCodexAppServerThread, q as ensureCodexPluginActivation, v as CODEX_NATIVE_PERSONALITY_NONE } from "./thread-lifecycle-DF53ogiA.js";
+import { _ as assertCodexThreadStartResponse } from "./transcript-mirror-DzsdNCf5.js";
+import { i as defaultCodexAppInventoryCache, r as buildCodexPluginAppCacheKey } from "./plugin-app-cache-key-DztPafOA.js";
 import { t as isIncognitoSessionKey } from "./incognito-session-ET_ufDH-.js";
 import { buildCodexMediaUnderstandingProvider } from "./media-understanding-provider.js";
-import { n as describeControlFailure, t as CODEX_CONTROL_METHODS } from "./capabilities-CLICvTxf.js";
-import { r as formatCodexDisplayText } from "./command-formatters-DgADqnHa.js";
-import { t as resolveCodexAppServerForModelProvider } from "./app-server-policy-BO3jYBkv.js";
-import { n as resolveCodexNativeExecutionBlock, r as resolveCodexNativeSandboxBlock } from "./sandbox-guard-D1Wky__S.js";
-import { d as CODEX_NATIVE_EXECUTION_AUTH_ERROR, f as canMutateCodexHost, u as trackCodexConversationActiveTurn } from "./conversation-control-sNPsbTCP.js";
+import { n as describeControlFailure, t as CODEX_CONTROL_METHODS } from "./capabilities-BFDTVYr4.js";
+import { r as formatCodexDisplayText } from "./command-formatters-C336eRVS.js";
+import { t as resolveCodexAppServerForModelProvider } from "./app-server-policy-BSaO2JIT.js";
+import { n as resolveCodexNativeExecutionBlock, r as resolveCodexNativeSandboxBlock } from "./sandbox-guard-NuhpXmPB.js";
+import { d as CODEX_NATIVE_EXECUTION_AUTH_ERROR, f as canMutateCodexHost, u as trackCodexConversationActiveTurn } from "./conversation-control-xsIeXbo4.js";
 import { a as readCodexConversationBindingDataRecord, i as readCodexConversationBindingData, o as resolveCodexDefaultWorkspaceDir, r as createCodexConversationBindingData } from "./conversation-binding-data-BHRpYbX3.js";
-import { a as resolveCodexBindingAppServerConnection, n as readCodexNotificationThreadId, r as readCodexNotificationTurnId } from "./notification-correlation-BGLixv5_.js";
-import { d as createCodexCliSessionNodeHostCommands, f as createCodexCliSessionNodeInvokePolicies, g as resumeCodexCliSessionOnNode, h as resolveCodexCliSessionForBindingOnNode, i as createCodexSessionCatalogNodeInvokePolicies, m as listCodexCliSessionsOnNode, n as createCodexSessionCatalogControl, o as codexControlRequest, r as createCodexSessionCatalogNodeHostCommands, t as codexSessionCatalogRuntime, u as assertCodexArchiveDescendantsUnowned } from "./session-catalog-DsKaezgR.js";
-import { r as requestCodexAppServerJson } from "./request-BTccUTD3.js";
+import { a as resolveCodexBindingAppServerConnection, n as readCodexNotificationThreadId, r as readCodexNotificationTurnId } from "./notification-correlation-CU6_AnOb.js";
+import { d as createCodexCliSessionNodeHostCommands, f as createCodexCliSessionNodeInvokePolicies, g as resumeCodexCliSessionOnNode, h as resolveCodexCliSessionForBindingOnNode, i as createCodexSessionCatalogNodeInvokePolicies, m as listCodexCliSessionsOnNode, n as createCodexSessionCatalogControl, o as codexControlRequest, r as createCodexSessionCatalogNodeHostCommands, t as codexSessionCatalogRuntime, u as assertCodexArchiveDescendantsUnowned } from "./session-catalog-DyOgR4WH.js";
+import { i as withCodexAppServerJsonClient, r as requestCodexAppServerJson } from "./request-qKh331yu.js";
 import { t as createCodexWebSearchProviderBase } from "./web-search-provider.shared-BrZmlqyR.js";
 import { mutateConfigFile } from "openclaw/plugin-sdk/config-mutation";
 import { normalizePluginsConfig, resolveEffectiveEnableState, resolveLivePluginConfigObject, resolvePluginConfigObject } from "openclaw/plugin-sdk/plugin-config-runtime";
@@ -24,19 +24,19 @@ import { definePluginEntry } from "openclaw/plugin-sdk/plugin-entry";
 import fs from "node:fs/promises";
 import path from "node:path";
 import { parseStrictNonNegativeInteger, resolveTimerTimeoutMs } from "openclaw/plugin-sdk/number-runtime";
+import { formatErrorMessage, resolveSandboxContext } from "openclaw/plugin-sdk/agent-harness-runtime";
+import { loadAuthProfileStoreWithoutExternalProfiles, resolveAgentConfig, resolveAgentWorkspaceDir, resolveDefaultAgentDir, resolveDefaultAgentId, resolveSessionAgentIds as resolveSessionAgentIds$1 } from "openclaw/plugin-sdk/agent-runtime";
 import os from "node:os";
-import { loadAuthProfileStoreWithoutExternalProfiles, resolveAgentConfig, resolveAgentWorkspaceDir, resolveDefaultAgentDir, resolveDefaultAgentId, resolveSessionAgentIds } from "openclaw/plugin-sdk/agent-runtime";
+import { applyAuthProfileConfig, buildApiKeyCredential, buildOauthProviderAuthResult, buildOpenAICodexCredentialExtra, readCodexCliCredentialsCached, resolveOpenAICodexAuthIdentity, resolveOpenAICodexImportProfileName, updateAuthProfileStoreWithLock } from "openclaw/plugin-sdk/provider-auth";
 import { loadExecApprovals } from "openclaw/plugin-sdk/exec-approvals-runtime";
 import { asBoolean, asOptionalRecord, isRecord, normalizeOptionalString, normalizeSingleOrTrimmedStringList, uniqueStrings } from "openclaw/plugin-sdk/string-coerce-runtime";
-import { formatErrorMessage, resolveSandboxContext } from "openclaw/plugin-sdk/agent-harness-runtime";
-import { applyAuthProfileConfig, buildApiKeyCredential, buildOauthProviderAuthResult, buildOpenAICodexCredentialExtra, readCodexCliCredentialsCached, resolveOpenAICodexAuthIdentity, resolveOpenAICodexImportProfileName, updateAuthProfileStoreWithLock } from "openclaw/plugin-sdk/provider-auth";
 import { getSessionEntry, resolveStorePath } from "openclaw/plugin-sdk/session-store-runtime";
 import { fileURLToPath } from "node:url";
 import { expectDefined } from "openclaw/plugin-sdk/expect-runtime";
-import { canonicalPathFromExistingAncestor, isPathInside, pathExists } from "openclaw/plugin-sdk/security-runtime";
+import { canonicalPathFromExistingAncestor, extractErrorCode, isPathInside, pathExists } from "openclaw/plugin-sdk/security-runtime";
 import { KeyedAsyncQueue } from "openclaw/plugin-sdk/keyed-async-queue";
 import { ModelSelectionLockedError, isModelSelectionLocked } from "openclaw/plugin-sdk/model-session-runtime";
-import { MIGRATION_REASON_TARGET_EXISTS, applyMigrationManualItem, createMigrationItem, createMigrationManualItem, hasMigrationConfigPatchConflict, markMigrationItemConflict, markMigrationItemError, markMigrationItemSkipped, readMigrationConfigPath, resolveMigrationConfigRuntime, summarizeMigrationItems, writeMigrationConfigPath } from "openclaw/plugin-sdk/migration";
+import { MIGRATION_REASON_TARGET_EXISTS, applyMigrationManualItem, createMigrationItem, createMigrationManualItem, hasMigrationConfigPatchConflict, markMigrationItemConflict, markMigrationItemError, markMigrationItemSkipped, mergeMigrationConfigValue, readMigrationConfigPath, resolveMigrationConfigRuntime, summarizeMigrationItems, writeMigrationConfigPath } from "openclaw/plugin-sdk/migration";
 import { archiveMigrationItem, copyMemoryMigrationFileItem, copyMigrationFileItem, withCachedMigrationConfigRuntime, writeMigrationReport } from "openclaw/plugin-sdk/migration-runtime";
 import { sleep } from "openclaw/plugin-sdk/runtime-env";
 import { readJsonFileWithFallback } from "openclaw/plugin-sdk/json-store";
@@ -47,13 +47,14 @@ import { createLazyRuntimeModule } from "openclaw/plugin-sdk/lazy-runtime";
 /** Defers schema compilation and auth loading until the first binding operation. */
 function createLazyCodexAppServerBindingStore(state) {
 	let resolved;
-	const store = () => resolved ??= import("./session-binding-ZSMX1omP.js").then((n) => n.u).then(({ createCodexAppServerBindingStore }) => createCodexAppServerBindingStore(state));
+	const store = () => resolved ??= import("./session-binding-BXpo9ymA.js").then((n) => n.f).then(({ createCodexAppServerBindingStore }) => createCodexAppServerBindingStore(state));
 	return {
 		read: async (identity) => (await store()).read(identity),
 		hasOtherThreadOwner: async (threadId, currentIdentity) => (await store()).hasOtherThreadOwner(threadId, currentIdentity),
 		mutate: async (identity, mutation) => (await store()).mutate(identity, mutation),
 		prepareSessionGenerationReclaim: async (identity) => (await store()).prepareSessionGenerationReclaim(identity),
 		adoptSessionGeneration: async (identity, previousSessionId) => (await store()).adoptSessionGeneration(identity, previousSessionId),
+		resetSessionGeneration: async (identity) => (await store()).resetSessionGeneration(identity),
 		retireSessionGeneration: async (identity) => (await store()).retireSessionGeneration(identity),
 		withThreadArchiveFence: async (run) => (await store()).withThreadArchiveFence(run),
 		withLease: async (identity, run) => (await store()).withLease(identity, run)
@@ -74,7 +75,7 @@ async function handleCodexCommand(ctx, options) {
 	}
 }
 async function loadDefaultCodexSubcommandHandler() {
-	const { handleCodexSubcommand } = await import("./command-handlers-l_lVPNlB.js");
+	const { handleCodexSubcommand } = await import("./command-handlers-DAHUSry9.js");
 	return handleCodexSubcommand;
 }
 //#endregion
@@ -937,7 +938,7 @@ async function prepareConversationBinding(params, options = {}) {
 	});
 }
 function resolveConversationExecPolicy(params) {
-	const agentId = params.agentId ?? (params.config ? resolveSessionAgentIds({
+	const agentId = params.agentId ?? (params.config ? resolveSessionAgentIds$1({
 		sessionKey: params.sessionKey,
 		config: params.config
 	}).sessionAgentId : void 0);
@@ -1082,7 +1083,7 @@ function sanitizeAppsNeedingAuth(apps) {
 	return apps.map((app) => ({
 		id: app.id,
 		name: app.name,
-		needsAuth: app.needsAuth
+		needsAuth: true
 	}));
 }
 //#endregion
@@ -1138,11 +1139,6 @@ async function readModelRefs(source) {
 	refs.add(OPENAI_CODEX_DEFAULT_MODEL);
 	return [...refs].toSorted();
 }
-function readProviderAuthModelConfigs(result) {
-	const models = result.configPatch?.agents?.defaults?.models;
-	if (isRecord(models)) return { ...models };
-	return { [normalizeOptionalString(result.defaultModel) ?? OPENAI_CODEX_DEFAULT_MODEL]: {} };
-}
 async function buildCodexOAuthCredential(source) {
 	const credential = readCodexCliCredentialsCached({
 		codexHome: source.codexHome,
@@ -1177,8 +1173,7 @@ async function buildCodexOAuthCredential(source) {
 		kind: "oauth",
 		provider: OPENAI_PROVIDER_ID,
 		profileId: profile.profileId,
-		result,
-		modelConfigs: readProviderAuthModelConfigs(result)
+		result
 	} : null;
 }
 async function buildCodexApiKeyCredential(source) {
@@ -1257,30 +1252,8 @@ function applyDefaultModelIfMissing(cfg) {
 		}
 	};
 }
-function mergeModelConfigEntry(existing, patch) {
-	if (existing && isRecord(existing) && isRecord(patch)) return {
-		...existing,
-		...patch
-	};
-	return existing ?? patch;
-}
-function applyOAuthModelConfigsToConfig(cfg, credential) {
-	const existingModels = cfg.agents?.defaults?.models ?? {};
-	const models = credential.result.replaceDefaultModels ? { ...credential.modelConfigs } : { ...existingModels };
-	if (!credential.result.replaceDefaultModels) for (const [modelRef, modelConfig] of Object.entries(credential.modelConfigs)) models[modelRef] = mergeModelConfigEntry(models[modelRef], modelConfig);
-	return {
-		...cfg,
-		agents: {
-			...cfg.agents,
-			defaults: {
-				...cfg.agents?.defaults,
-				models
-			}
-		}
-	};
-}
 function applyOAuthConfigToConfig(cfg, credential, profileId) {
-	let next = applyOAuthModelConfigsToConfig(cfg, credential);
+	let next = mergeMigrationConfigValue(cfg, credential.result.configPatch);
 	const profile = credential.result.profiles[0];
 	if (profile) next = applyAuthProfileConfig(next, {
 		profileId,
@@ -1304,28 +1277,23 @@ function applyApiKeyConfigToConfig(cfg, credential, profileId) {
 function shouldReturnAuthConfigPatch(ctx) {
 	return ctx.providerOptions?.configPatchMode === CODEX_CONFIG_PATCH_MODE_RETURN$1;
 }
-function oauthAuthProfileConfig(credential, profileId) {
+function authProfileConfigForCredential(credential, profileId) {
+	if (credential.kind === "api_key") return {
+		profileId,
+		provider: credential.provider,
+		mode: "api_key",
+		displayName: CODEX_IMPORT_DISPLAY_NAME
+	};
 	const profile = credential.result.profiles[0];
 	if (!profile || profile.credential.type !== "oauth") return null;
 	return {
 		profileId,
 		provider: profile.credential.provider,
 		mode: "oauth",
-		..."email" in profile.credential && profile.credential.email ? { email: profile.credential.email } : {},
-		..."displayName" in profile.credential && profile.credential.displayName ? { displayName: profile.credential.displayName } : {}
-	};
-}
-function apiKeyAuthProfileConfig(credential, profileId) {
-	return {
-		profileId,
-		provider: credential.provider,
-		mode: "api_key",
-		displayName: CODEX_IMPORT_DISPLAY_NAME
+		...profile.credential.email ? { email: profile.credential.email } : {},
+		...profile.credential.displayName ? { displayName: profile.credential.displayName } : {}
 	};
 }
-function authProfileConfigForCredential(credential, profileId) {
-	return credential.kind === "oauth" ? oauthAuthProfileConfig(credential, profileId) : apiKeyAuthProfileConfig(credential, profileId);
-}
 async function applyCodexAuthProfileConfig(ctx, profile, applyConfig) {
 	const configApi = resolveMigrationConfigRuntime(ctx);
 	if (!configApi?.current || !configApi.mutateConfigFile) return "unavailable";
@@ -1344,13 +1312,13 @@ async function applyCodexAuthProfileConfig(ctx, profile, applyConfig) {
 		return error instanceof CodexAuthConfigConflict ? "conflict" : "unavailable";
 	}
 }
-async function applyOAuthConfig(ctx, credential, profileId) {
-	const profile = oauthAuthProfileConfig(credential, profileId);
+async function applyCodexAuthConfig(ctx, credential, profileId) {
+	const profile = authProfileConfigForCredential(credential, profileId);
 	if (!profile) return "unavailable";
-	return applyCodexAuthProfileConfig(ctx, profile, (config) => applyOAuthConfigToConfig(config, credential, profileId));
+	return applyCodexAuthProfileConfig(ctx, profile, (config) => applyCredentialConfig(config, credential, profileId));
 }
-async function applyApiKeyConfig(ctx, credential, profileId) {
-	return applyCodexAuthProfileConfig(ctx, apiKeyAuthProfileConfig(credential, profileId), (config) => applyApiKeyConfigToConfig(config, credential, profileId));
+function applyCredentialConfig(config, credential, profileId) {
+	return credential.kind === "oauth" ? applyOAuthConfigToConfig(config, credential, profileId) : applyApiKeyConfigToConfig(config, credential, profileId);
 }
 async function buildCodexAuthItems(params) {
 	const credentials = await readCodexAuthCredentials(params.source);
@@ -1383,22 +1351,22 @@ async function buildCodexAuthItems(params) {
 		});
 	});
 }
-async function applyCodexAuthItem(params) {
+async function applyCodexAuthItems(params) {
 	const { ctx, item, source, targets } = params;
-	if (item.status !== "planned") return item;
+	if (item.status !== "planned") return [item];
 	const profileId = typeof item.details?.profileId === "string" ? item.details.profileId : "";
 	const provider = typeof item.details?.provider === "string" ? item.details.provider : "";
 	const sourceProfileId = typeof item.details?.sourceProfileId === "string" ? item.details.sourceProfileId : void 0;
-	if (!profileId || !provider) return markMigrationItemError(item, CODEX_REASON_MISSING_AUTH_METADATA);
+	if (!profileId || !provider) return [markMigrationItemError(item, CODEX_REASON_MISSING_AUTH_METADATA)];
 	const credential = (await readCodexAuthCredentials(source)).find((candidate) => candidate.provider === provider);
-	if (!credential) return markMigrationItemSkipped(item, CODEX_REASON_AUTH_NO_LONGER_PRESENT);
-	if (credential.kind === "oauth" && sourceProfileId && credential.profileId !== sourceProfileId) return markMigrationItemSkipped(item, CODEX_REASON_AUTH_NO_LONGER_PRESENT);
+	if (!credential) return [markMigrationItemSkipped(item, CODEX_REASON_AUTH_NO_LONGER_PRESENT)];
+	if (credential.kind === "oauth" && sourceProfileId && credential.profileId !== sourceProfileId) return [markMigrationItemSkipped(item, CODEX_REASON_AUTH_NO_LONGER_PRESENT)];
 	const oauthProfile = credential.kind === "oauth" ? credential.result.profiles[0] : void 0;
 	const oauthCredential = oauthProfile?.credential.type === "oauth" ? oauthProfile.credential : void 0;
-	if (credential.kind === "oauth" && !oauthCredential) return markMigrationItemError(item, CODEX_REASON_MISSING_AUTH_METADATA);
+	if (credential.kind === "oauth" && !oauthCredential) return [markMigrationItemError(item, CODEX_REASON_MISSING_AUTH_METADATA)];
 	const configProfile = authProfileConfigForCredential(credential, profileId);
-	if (!configProfile) return markMigrationItemError(item, CODEX_REASON_MISSING_AUTH_METADATA);
-	if (hasCurrentAuthProfileConfigConflict(ctx, configProfile)) return markMigrationItemConflict(item, CODEX_REASON_AUTH_PROFILE_EXISTS);
+	if (!configProfile) return [markMigrationItemError(item, CODEX_REASON_MISSING_AUTH_METADATA)];
+	if (hasCurrentAuthProfileConfigConflict(ctx, configProfile)) return [markMigrationItemConflict(item, CODEX_REASON_AUTH_PROFILE_EXISTS)];
 	let conflicted = false;
 	let wrote = false;
 	const store = await updateAuthProfileStoreWithLock({
@@ -1422,11 +1390,11 @@ async function applyCodexAuthItem(params) {
 			return true;
 		}
 	});
-	if (conflicted) return markMigrationItemConflict(item, CODEX_REASON_AUTH_PROFILE_EXISTS);
-	if (!store?.profiles[profileId]) return markMigrationItemError(item, CODEX_REASON_AUTH_PROFILE_WRITE_FAILED);
-	const configResult = shouldReturnAuthConfigPatch(ctx) ? "unavailable" : credential.kind === "oauth" ? await applyOAuthConfig(ctx, credential, profileId) : await applyApiKeyConfig(ctx, credential, profileId);
-	if (configResult === "conflict") return markMigrationItemConflict(item, CODEX_REASON_AUTH_PROFILE_EXISTS);
-	return {
+	if (conflicted) return [markMigrationItemConflict(item, CODEX_REASON_AUTH_PROFILE_EXISTS)];
+	if (!store?.profiles[profileId]) return [markMigrationItemError(item, CODEX_REASON_AUTH_PROFILE_WRITE_FAILED)];
+	const configResult = shouldReturnAuthConfigPatch(ctx) ? "unavailable" : await applyCodexAuthConfig(ctx, credential, profileId);
+	if (configResult === "conflict") return [markMigrationItemConflict(item, CODEX_REASON_AUTH_PROFILE_EXISTS)];
+	const migratedItem = {
 		...item,
 		status: "migrated",
 		details: {
@@ -1436,18 +1404,10 @@ async function applyCodexAuthItem(params) {
 			...shouldReturnAuthConfigPatch(ctx) ? { configPatchReturned: true } : {}
 		}
 	};
+	return [migratedItem, ...shouldReturnAuthConfigPatch(ctx) ? buildCodexAuthConfigPatchItems(ctx, migratedItem, credential, profileId) : []];
 }
-async function buildCodexAuthConfigPatchItems(params) {
-	const { ctx, item, source } = params;
-	if (item.status !== "migrated" || !shouldReturnAuthConfigPatch(ctx)) return [];
-	const profileId = typeof item.details?.profileId === "string" ? item.details.profileId : "";
-	const provider = typeof item.details?.provider === "string" ? item.details.provider : "";
-	const sourceProfileId = typeof item.details?.sourceProfileId === "string" ? item.details.sourceProfileId : void 0;
-	if (!profileId || !provider) return [];
-	const credential = (await readCodexAuthCredentials(source)).find((candidate) => candidate.provider === provider);
-	if (!credential) return [];
-	if (credential.kind === "oauth" && sourceProfileId && credential.profileId !== sourceProfileId) return [];
-	const next = credential.kind === "oauth" ? applyOAuthConfigToConfig(ctx.config, credential, profileId) : applyApiKeyConfigToConfig(ctx.config, credential, profileId);
+function buildCodexAuthConfigPatchItems(ctx, item, credential, profileId) {
+	const next = applyCredentialConfig(ctx.config, credential, profileId);
 	const items = [];
 	if (next.auth) items.push(createMigrationItem({
 		id: `${item.id}:config:auth`,
@@ -1476,108 +1436,6 @@ async function buildCodexAuthConfigPatchItems(params) {
 	return items;
 }
 //#endregion
-//#region extensions/codex/src/migration/memory-plan.ts
-const MIGRATION_REASON_TARGET_NOT_REGULAR = "target is not a regular file";
-async function lstatIfExists(filePath) {
-	try {
-		return await fs.lstat(filePath);
-	} catch (error) {
-		const code = error && typeof error === "object" && "code" in error ? String(error.code) : void 0;
-		if (code === "ENOENT" || code === "ENOTDIR") return;
-		throw error;
-	}
-}
-async function assertSafeMemoryDestination(params) {
-	const [canonicalSource, canonicalWorkspace, canonicalTarget] = await Promise.all([
-		fs.realpath(path.dirname(params.source)),
-		canonicalPathFromExistingAncestor(params.workspaceDir),
-		canonicalPathFromExistingAncestor(params.target)
-	]);
-	if (!isPathInside(canonicalWorkspace, canonicalTarget)) throw new Error("Codex memory import destination must stay in the selected workspace.");
-	if (isPathInside(canonicalSource, canonicalTarget) || isPathInside(canonicalTarget, canonicalSource)) throw new Error("Codex memory source and OpenClaw import destination must be separate paths.");
-}
-async function buildCodexMemoryItems(params) {
-	const items = [];
-	for (const memory of params.memoryFiles) {
-		const target = path.join(params.workspaceDir, "memory", "imports", "codex", path.basename(memory.path));
-		const targetStat = await lstatIfExists(target);
-		const targetExists = targetStat !== void 0;
-		const targetNotRegular = targetExists && !targetStat.isFile();
-		if (!targetNotRegular) await assertSafeMemoryDestination({
-			source: memory.path,
-			workspaceDir: params.workspaceDir,
-			target
-		});
-		const targetConflict = targetNotRegular || targetExists && !params.overwrite;
-		items.push(createMigrationItem({
-			id: memory.id,
-			kind: "memory",
-			action: "copy",
-			source: memory.path,
-			target,
-			status: targetConflict ? "conflict" : "planned",
-			reason: targetNotRegular ? MIGRATION_REASON_TARGET_NOT_REGULAR : targetConflict ? MIGRATION_REASON_TARGET_EXISTS : void 0,
-			message: "Copy consolidated Codex memory into the OpenClaw memory index.",
-			details: {
-				sourceType: "codex-memory",
-				sourceLabel: memory.label,
-				collectionId: "codex",
-				collectionLabel: "Codex",
-				relativePath: path.basename(memory.path)
-			}
-		}));
-	}
-	return items;
-}
-//#endregion
-//#region extensions/codex/src/migration/skill-plan.ts
-function uniqueSkillName(skill, counts) {
-	const base = sanitizeName(skill.name) || "codex-skill";
-	if ((counts.get(base) ?? 0) <= 1) return base;
-	return sanitizeName([
-		"codex",
-		sanitizeName(path.basename(path.dirname(skill.source))),
-		base
-	].filter(Boolean).join("-")) || base;
-}
-async function buildCodexSkillItems(params) {
-	const baseCounts = /* @__PURE__ */ new Map();
-	for (const skill of params.skills) {
-		const base = sanitizeName(skill.name) || "codex-skill";
-		baseCounts.set(base, (baseCounts.get(base) ?? 0) + 1);
-	}
-	const resolvedCounts = /* @__PURE__ */ new Map();
-	const planned = params.skills.map((skill) => {
-		const name = uniqueSkillName(skill, baseCounts);
-		resolvedCounts.set(name, (resolvedCounts.get(name) ?? 0) + 1);
-		return {
-			skill,
-			name,
-			target: path.join(params.workspaceDir, "skills", name)
-		};
-	});
-	const items = [];
-	for (const item of planned) {
-		const collides = (resolvedCounts.get(item.name) ?? 0) > 1;
-		const targetExists = await exists(item.target);
-		items.push(createMigrationItem({
-			id: `skill:${item.name}`,
-			kind: "skill",
-			action: "copy",
-			source: item.skill.source,
-			target: item.target,
-			status: collides ? "conflict" : targetExists && !params.overwrite ? "conflict" : "planned",
-			reason: collides ? `multiple Codex skills normalize to "${item.name}"` : targetExists && !params.overwrite ? MIGRATION_REASON_TARGET_EXISTS : void 0,
-			message: `Copy ${item.skill.sourceLabel} into this OpenClaw agent workspace.`,
-			details: {
-				skillName: item.name,
-				sourceLabel: item.skill.sourceLabel
-			}
-		}));
-	}
-	return items;
-}
-//#endregion
 //#region extensions/codex/src/migration/source-files.ts
 const SKILL_FILENAME = "SKILL.md";
 const MAX_SCAN_DEPTH = 6;
@@ -1618,8 +1476,6 @@ async function discoverPluginDirs(codexHome) {
 			discovered.set(dir, {
 				name: manifestName || path.basename(dir),
 				source: dir,
-				manifestPath,
-				sourceKind: "cache",
 				migratable: false,
 				message: "Cached Codex plugin bundle found. Review manually unless the plugin is also installed in the source Codex app-server inventory"
 			});
@@ -1643,7 +1499,7 @@ async function discoverCodexMemoryFile(candidate) {
 }
 async function discoverCodexMemorySources(codexHome) {
 	const memoriesDir = path.join(codexHome, "memories");
-	const memoryFiles = (await Promise.all([{
+	return (await Promise.all([{
 		id: "memory:codex:MEMORY.md",
 		label: "Codex consolidated memory",
 		name: "MEMORY.md"
@@ -1656,10 +1512,6 @@ async function discoverCodexMemorySources(codexHome) {
 		label: candidate.label,
 		path: path.join(memoriesDir, candidate.name)
 	})))).filter((entry) => entry !== void 0);
-	return {
-		...await isDirectory(memoriesDir) ? { memoriesDir } : {},
-		memoryFiles
-	};
 }
 //#endregion
 //#region extensions/codex/src/migration/source.ts
@@ -1671,23 +1523,35 @@ function personalAgentsSkillsDir() {
 	return path.join(resolveUserHomeDir(), ".agents", "skills");
 }
 async function discoverInstalledCuratedPlugins(codexHome, options = {}) {
-	const requestOptions = { startOptions: sourceCodexAppServerStartOptions(codexHome) };
+	const startOptions = sourceCodexAppServerStartOptions(codexHome);
 	try {
-		const marketplace = (await requestSourceCodexAppServerJson(requestOptions, {
-			method: "plugin/list",
-			requestParams: { cwds: [] }
-		})).marketplaces.find((entry) => entry.name === CODEX_PLUGINS_MARKETPLACE_NAME);
-		if (!marketplace) return {
-			plugins: [],
-			error: `Codex marketplace ${CODEX_PLUGINS_MARKETPLACE_NAME} was not found in source plugin inventory.`
-		};
-		const plugins = marketplace.plugins.filter((plugin) => plugin.installed).map((plugin) => buildInstalledPluginSource(plugin)).filter((plugin) => plugin !== void 0);
-		return { plugins: (options.evaluatePluginMigrationEligibility === true ? await withPluginMigrationEligibility({
-			plugins,
-			marketplace: marketplaceRef(marketplace),
-			requestOptions,
-			verifyPluginApps: options.verifyPluginApps === true
-		}) : plugins).toSorted((a, b) => (a.pluginName ?? a.name).localeCompare(b.pluginName ?? b.name)) };
+		return await withCodexAppServerJsonClient({
+			timeoutMs: 6e4,
+			startOptions,
+			authProfileId: null,
+			isolated: true
+		}, async (request) => {
+			const requestOptions = {
+				startOptions,
+				request
+			};
+			const response = await request({
+				method: "plugin/installed",
+				requestParams: { cwds: [] }
+			});
+			const curatedSyncRoot = path.join(codexHome, ".tmp", "plugins");
+			const curatedMarketplaceErrors = response.marketplaceLoadErrors.filter((error) => isPathInside(curatedSyncRoot, error.marketplacePath));
+			if (curatedMarketplaceErrors.length > 0) return {
+				plugins: [],
+				error: curatedMarketplaceErrors.map((error) => error.message).join("; ")
+			};
+			const installed = discoverInstalledCuratedPluginSources(response);
+			return { plugins: (options.evaluatePluginMigrationEligibility === true ? await withPluginMigrationEligibility({
+				plugins: installed,
+				requestOptions,
+				verifyPluginApps: options.verifyPluginApps === true
+			}) : installed.map(({ plugin }) => plugin)).toSorted((left, right) => (left.pluginName ?? left.name).localeCompare(right.pluginName ?? right.name)) };
+		});
 	} catch (error) {
 		return {
 			plugins: [],
@@ -1713,16 +1577,6 @@ function sourceCodexAppServerStartOptions(codexHome) {
 		}
 	};
 }
-async function requestSourceCodexAppServerJson(options, params) {
-	return await requestCodexAppServerJson({
-		method: params.method,
-		requestParams: params.requestParams,
-		timeoutMs: 6e4,
-		startOptions: options.startOptions,
-		authProfileId: null,
-		isolated: true
-	});
-}
 function buildInstalledPluginSource(plugin) {
 	const pluginName = pluginNameFromSummary(plugin);
 	if (!pluginName) return;
@@ -1731,12 +1585,32 @@ function buildInstalledPluginSource(plugin) {
 		pluginName,
 		marketplaceName: CODEX_PLUGINS_MARKETPLACE_NAME,
 		source: `${CODEX_PLUGINS_MARKETPLACE_NAME}/${pluginName}`,
-		sourceKind: "app-server",
 		migratable: true,
 		installed: plugin.installed,
 		enabled: plugin.enabled
 	};
 }
+function discoverInstalledCuratedPluginSources(response) {
+	const installedByName = /* @__PURE__ */ new Map();
+	for (const marketplace of response.marketplaces) {
+		if (!isOpenAiCuratedMarketplace(marketplace)) continue;
+		const remote = !marketplace.path;
+		for (const summary of marketplace.plugins) {
+			if (!summary.installed) continue;
+			const plugin = buildInstalledPluginSource(summary);
+			if (!plugin?.pluginName) continue;
+			const existing = installedByName.get(plugin.pluginName);
+			if (existing && (!remote || existing.remote)) continue;
+			installedByName.set(plugin.pluginName, {
+				plugin,
+				marketplace: marketplaceRef(marketplace),
+				...remote ? { readPluginName: summary.remotePluginId?.trim() || void 0 } : { readPluginName: plugin.pluginName },
+				remote
+			});
+		}
+	}
+	return Array.from(installedByName.values());
+}
 function marketplaceRef(marketplace) {
 	return {
 		name: CODEX_PLUGINS_MARKETPLACE_NAME,
@@ -1747,7 +1621,7 @@ function marketplaceRef(marketplace) {
 async function withPluginMigrationEligibility(params) {
 	const pending = [];
 	const evaluated = [];
-	for (const plugin of params.plugins) {
+	for (const { plugin, marketplace, readPluginName } of params.plugins) {
 		if (plugin.enabled !== true) {
 			evaluated.push({
 				...plugin,
@@ -1757,7 +1631,7 @@ async function withPluginMigrationEligibility(params) {
 			});
 			continue;
 		}
-		const detail = await readPluginDetail(params.requestOptions, params.marketplace, plugin);
+		const detail = await readPluginDetail(params.requestOptions, marketplace, plugin, readPluginName);
 		if (!detail.ok) {
 			evaluated.push({
 				...plugin,
@@ -1785,25 +1659,27 @@ async function withPluginMigrationEligibility(params) {
 	}
 	if (pending.length === 0) return evaluated;
 	let sourceAccount;
+	let sourceAccountError;
 	try {
 		sourceAccount = await readSourceCodexAccount(params.requestOptions);
+		if (sourceAccount === "missing") sourceAccountError = "Codex app-server did not report an authenticated source account.";
 	} catch (error) {
-		if (!params.verifyPluginApps) {
-			const message = error instanceof Error ? error.message : String(error);
-			for (const { plugin, apps } of pending) evaluated.push({
-				...plugin,
-				migratable: false,
-				migrationBlock: {
-					code: "codex_account_unavailable",
-					apps,
-					error: message
-				},
-				message: `Codex plugin "${plugin.pluginName ?? plugin.name}" owns apps, but the source Codex app-server account could not be read: ${message}`
-			});
-			return evaluated;
-		}
+		sourceAccountError = error instanceof Error ? error.message : String(error);
 	}
-	if (sourceAccount && sourceAccount !== "chatgpt") {
+	if (sourceAccountError && !params.verifyPluginApps) {
+		for (const { plugin, apps } of pending) evaluated.push({
+			...plugin,
+			migratable: false,
+			migrationBlock: {
+				code: "codex_account_unavailable",
+				apps,
+				error: sourceAccountError
+			},
+			message: `Codex plugin "${plugin.pluginName ?? plugin.name}" owns apps, but the source Codex app-server account could not be read: ${sourceAccountError}`
+		});
+		return evaluated;
+	}
+	if (sourceAccount === "non_chatgpt") {
 		for (const { plugin, apps } of pending) evaluated.push({
 			...plugin,
 			migratable: false,
@@ -1838,8 +1714,9 @@ async function withPluginMigrationEligibility(params) {
 	});
 	if (!snapshot) return evaluated;
 	const appInfoById = new Map(snapshot.apps.map((app) => [app.id, app]));
+	const installedAppsById = new Map(snapshot.installedApps.map((app) => [app.id, app]));
 	for (const { plugin, apps: declaredApps } of pending) {
-		const apps = declaredApps.map((app) => sourcePluginAppFactWithInventory(app, appInfoById.get(app.id))).toSorted((left, right) => left.id.localeCompare(right.id));
+		const apps = declaredApps.map((app) => sourcePluginAppFactWithInventory(app, appInfoById.get(app.id), installedAppsById.get(app.id))).toSorted((left, right) => left.id.localeCompare(right.id));
 		const blockCode = migrationBlockCodeForApps(apps);
 		if (!blockCode) {
 			evaluated.push({
@@ -1862,20 +1739,29 @@ async function withPluginMigrationEligibility(params) {
 	return evaluated;
 }
 async function readSourceCodexAccount(options) {
-	const response = await requestSourceCodexAppServerJson(options, {
+	const response = await options.request({
 		method: "account/read",
 		requestParams: { refreshToken: false }
 	});
 	if (!response.account || typeof response.account !== "object" || Array.isArray(response.account)) return "missing";
-	return response.account.type === "chatgpt" ? "chatgpt" : "non_chatgpt";
+	switch (response.account.type) {
+		case "chatgpt": return "chatgpt";
+		case "apiKey":
+		case "amazonBedrock": return "non_chatgpt";
+		default: return "missing";
+	}
 }
-async function readPluginDetail(options, marketplace, plugin) {
+async function readPluginDetail(options, marketplace, plugin, readPluginName) {
+	if (!readPluginName) return {
+		ok: false,
+		error: `Codex remote plugin "${plugin.pluginName ?? plugin.name}" has no readable remote plugin id.`
+	};
 	try {
 		return {
 			ok: true,
-			detail: (await requestSourceCodexAppServerJson(options, {
+			detail: (await options.request({
 				method: "plugin/read",
-				requestParams: pluginReadParams(marketplace, plugin.pluginName ?? plugin.name)
+				requestParams: pluginReadParams(marketplace, readPluginName)
 			})).plugin
 		};
 	} catch (error) {
@@ -1887,7 +1773,7 @@ async function readPluginDetail(options, marketplace, plugin) {
 }
 async function refreshSourceAppInventory(options) {
 	const key = buildCodexPluginAppCacheKey({ appServer: { start: options.startOptions } });
-	const request = async (method, requestParams) => await requestSourceCodexAppServerJson(options, {
+	const request = async (method, requestParams) => await options.request({
 		method,
 		requestParams
 	});
@@ -1900,16 +1786,29 @@ async function refreshSourceAppInventory(options) {
 function sourcePluginAppFact(app) {
 	return {
 		id: app.id,
-		name: app.name,
-		needsAuth: app.needsAuth
+		name: app.name
 	};
 }
-function sourcePluginAppFactWithInventory(app, info) {
-	if (!info) return app;
-	return {
+function sourcePluginAppFactWithInventory(app, info, installedApp) {
+	if (!installedApp) return app;
+	if (!info) return installedApp.enabled ? {
+		...app,
+		isAccessible: false,
+		isEnabled: true
+	} : {
+		...app,
+		isEnabled: false
+	};
+	if (!installedApp.enabled) return {
 		...app,
 		isAccessible: info.isAccessible,
-		isEnabled: info.isEnabled
+		isEnabled: false
+	};
+	return {
+		...app,
+		isAccessible: info.isAccessible && installedApp.callable,
+		isEnabled: info.isEnabled,
+		...!installedApp.callable ? { isCallable: false } : {}
 	};
 }
 function migrationBlockCodeForApps(apps) {
@@ -1918,7 +1817,7 @@ function migrationBlockCodeForApps(apps) {
 	if (apps.some((app) => app.isAccessible === void 0 || app.isEnabled === void 0)) return "app_missing";
 }
 function appInventoryBlockMessage(plugin, apps, code) {
-	const status = code === "app_inaccessible" ? "inaccessible" : code === "app_disabled" ? "disabled" : "missing";
+	const status = code === "app_inaccessible" ? apps.some((app) => app.isCallable === false) ? "not callable" : "inaccessible" : code === "app_disabled" ? "disabled" : "missing";
 	const blocking = apps.find((app) => code === "app_inaccessible" ? app.isAccessible === false : code === "app_disabled" ? app.isEnabled === false : app.isAccessible === void 0 || app.isEnabled === void 0) ?? apps[0];
 	const appLabel = blocking ? ` app "${blocking.name}"` : " an owned app";
 	return `Codex plugin "${plugin.pluginName ?? plugin.name}" owns${appLabel} but the source app inventory reports it is ${status}; authenticate or enable the app in Codex before migrating it to OpenClaw.`;
@@ -1930,16 +1829,20 @@ function codexSubscriptionRequiredMessage(plugin) {
 	return `Codex plugin "${plugin.pluginName ?? plugin.name}" owns apps, but ${codexPluginMigrationSubscriptionWarning()}`;
 }
 function pluginNameFromSummary(summary) {
-	const candidates = [summary.id, summary.name];
+	const candidates = [summary.name, summary.id];
 	for (const candidate of candidates) {
 		const trimmed = candidate.trim();
 		if (!trimmed) continue;
-		const normalized = ((trimmed.endsWith(`@openai-curated`) ? trimmed.slice(0, -`@${CODEX_PLUGINS_MARKETPLACE_NAME}`.length) : trimmed).split("/").at(-1)?.trim())?.toLowerCase().replaceAll(/\s+/gu, "-");
+		const marketplaceSuffix = [
+			`@${CODEX_PLUGINS_MARKETPLACE_NAME}-remote`,
+			`@openai-api-curated`,
+			`@${CODEX_PLUGINS_MARKETPLACE_NAME}`
+		].find((suffix) => trimmed.endsWith(suffix));
+		const normalized = ((marketplaceSuffix ? trimmed.slice(0, -marketplaceSuffix.length) : trimmed).split("/").at(-1)?.trim())?.toLowerCase().replaceAll(/\s+/gu, "-");
 		if (normalized) return normalized;
 	}
 }
-async function discoverCodexSource(inputOrOptions) {
-	const options = typeof inputOrOptions === "string" || inputOrOptions === void 0 ? { input: inputOrOptions } : inputOrOptions;
+async function discoverCodexSource(options = {}) {
 	const codexHome = resolveHomePath(options.input?.trim() || defaultCodexHome());
 	const codexSkillsDir = path.join(codexHome, "skills");
 	const agentsSkillsDir = personalAgentsSkillsDir();
@@ -1947,7 +1850,7 @@ async function discoverCodexSource(inputOrOptions) {
 	const authPath = path.join(codexHome, "auth.json");
 	const modelsCachePath = path.join(codexHome, "models_cache.json");
 	const hooksPath = path.join(codexHome, "hooks", "hooks.json");
-	const { memoriesDir, memoryFiles } = await discoverCodexMemorySources(codexHome);
+	const memoryFiles = await discoverCodexMemorySources(codexHome);
 	const codexSkills = options.memoryOnly ? [] : await discoverSkillDirs({
 		root: codexSkillsDir,
 		sourceLabel: "Codex skill",
@@ -1987,11 +1890,8 @@ async function discoverCodexSource(inputOrOptions) {
 		codexHome,
 		...await isDirectory(codexSkillsDir) ? { codexSkillsDir } : {},
 		...await isDirectory(agentsSkillsDir) ? { personalAgentsSkillsDir: agentsSkillsDir } : {},
-		...await exists(configPath) ? { configPath } : {},
 		...hasAuth ? { authPath } : {},
 		...await exists(modelsCachePath) ? { modelsCachePath } : {},
-		...await exists(hooksPath) ? { hooksPath } : {},
-		...memoriesDir ? { memoriesDir } : {},
 		memoryFiles,
 		skills,
 		plugins,
@@ -2040,12 +1940,98 @@ const CODEX_PLUGIN_NATIVE_CONFIG_PATH = [
 ];
 const MIGRATION_REASON_PLUGIN_EXISTS = "plugin exists";
 const CODEX_PLUGIN_SOURCE_APP_VERIFICATION_UNVERIFIED = "not_run";
-function uniquePluginConfigKey(plugin, counts, usedCounts) {
-	const base = sanitizeName(plugin.pluginName ?? plugin.name) || "codex-plugin";
+const MIGRATION_REASON_TARGET_NOT_REGULAR = "target is not a regular file";
+async function lstatIfExists(filePath) {
+	try {
+		return await fs.lstat(filePath);
+	} catch (error) {
+		const code = extractErrorCode(error);
+		if (code === "ENOENT" || code === "ENOTDIR") return;
+		throw error;
+	}
+}
+async function buildCodexMemoryItems(params) {
+	const items = [];
+	for (const memory of params.memoryFiles) {
+		const target = path.join(params.workspaceDir, "memory", "imports", "codex", path.basename(memory.path));
+		const targetStat = await lstatIfExists(target);
+		const targetNotRegular = targetStat !== void 0 && !targetStat.isFile();
+		if (!targetNotRegular) {
+			const [source, workspace, destination] = await Promise.all([
+				fs.realpath(path.dirname(memory.path)),
+				canonicalPathFromExistingAncestor(params.workspaceDir),
+				canonicalPathFromExistingAncestor(target)
+			]);
+			if (!isPathInside(workspace, destination)) throw new Error("Codex memory import destination must stay in the selected workspace.");
+			if (isPathInside(source, destination) || isPathInside(destination, source)) throw new Error("Codex memory source and OpenClaw import destination must be separate paths.");
+		}
+		const targetConflict = targetStat !== void 0 && !params.overwrite;
+		items.push(createMigrationItem({
+			id: memory.id,
+			kind: "memory",
+			action: "copy",
+			source: memory.path,
+			target,
+			status: targetNotRegular || targetConflict ? "conflict" : "planned",
+			reason: targetNotRegular ? MIGRATION_REASON_TARGET_NOT_REGULAR : targetConflict ? MIGRATION_REASON_TARGET_EXISTS : void 0,
+			message: "Copy consolidated Codex memory into the OpenClaw memory index.",
+			details: {
+				sourceType: "codex-memory",
+				sourceLabel: memory.label,
+				collectionId: "codex",
+				collectionLabel: "Codex",
+				relativePath: path.basename(memory.path)
+			}
+		}));
+	}
+	return items;
+}
+function uniqueSkillName(skill, counts) {
+	const base = sanitizeName(skill.name) || "codex-skill";
 	if ((counts.get(base) ?? 0) <= 1) return base;
-	const next = (usedCounts.get(base) ?? 0) + 1;
-	usedCounts.set(base, next);
-	return sanitizeName(`${base}-${next}`) || base;
+	return sanitizeName([
+		"codex",
+		sanitizeName(path.basename(path.dirname(skill.source))),
+		base
+	].filter(Boolean).join("-")) || base;
+}
+async function buildCodexSkillItems(params) {
+	const counts = /* @__PURE__ */ new Map();
+	for (const skill of params.skills) {
+		const base = sanitizeName(skill.name) || "codex-skill";
+		counts.set(base, (counts.get(base) ?? 0) + 1);
+	}
+	const planned = params.skills.map((skill) => {
+		const name = uniqueSkillName(skill, counts);
+		return {
+			skill,
+			name,
+			target: path.join(params.workspaceDir, "skills", name)
+		};
+	});
+	const resolvedCounts = planned.reduce((resolved, item) => {
+		resolved.set(item.name, (resolved.get(item.name) ?? 0) + 1);
+		return resolved;
+	}, /* @__PURE__ */ new Map());
+	return await Promise.all(planned.map(async (item) => {
+		const collision = (resolvedCounts.get(item.name) ?? 0) > 1;
+		const targetExists = await exists(item.target);
+		const conflict = collision || targetExists && !params.overwrite;
+		return createMigrationItem({
+			id: `skill:${item.name}`,
+			kind: "skill",
+			action: "copy",
+			source: item.skill.source,
+			target: item.target,
+			status: conflict ? "conflict" : "planned",
+			reason: collision ? `multiple Codex skills normalize to "${item.name}"` : conflict ? MIGRATION_REASON_TARGET_EXISTS : void 0,
+			message: `Copy ${item.skill.sourceLabel} into this OpenClaw agent workspace.`,
+			details: {
+				skillName: item.name,
+				sourceLabel: item.skill.sourceLabel
+			}
+		});
+	}));
 }
 function readExistingCodexPluginEntries(config) {
 	const entries = readMigrationConfigPath(config, [...CODEX_PLUGIN_NATIVE_CONFIG_PATH, "plugins"]);
@@ -2076,18 +2062,12 @@ function readExistingPluginAllowDestructiveActions(existing, pluginName) {
 	return normalized === "auto" || normalized === "ask" ? normalized : void 0;
 }
 function buildPluginItems(ctx, plugins) {
-	const baseCounts = /* @__PURE__ */ new Map();
-	for (const plugin of plugins.filter((entry) => entry.migratable)) {
-		const base = sanitizeName(plugin.pluginName ?? plugin.name) || "codex-plugin";
-		baseCounts.set(base, (baseCounts.get(base) ?? 0) + 1);
-	}
 	const existingPluginEntries = readExistingCodexPluginEntries(ctx.config);
-	const usedCounts = /* @__PURE__ */ new Map();
 	let manualIndex = 0;
 	const items = [];
 	for (const plugin of plugins) {
 		if (plugin.migratable && plugin.marketplaceName === "openai-curated" && plugin.pluginName) {
-			const configKey = uniquePluginConfigKey(plugin, baseCounts, usedCounts);
+			const configKey = plugin.pluginName;
 			const plannedEntry = {
 				enabled: true,
 				marketplaceName: CODEX_PLUGINS_MARKETPLACE_NAME,
@@ -2122,12 +2102,6 @@ function buildPluginItems(ctx, plugins) {
 		}
 		manualIndex += 1;
 		if (plugin.migrationBlock && plugin.pluginName) {
-			const details = {
-				pluginName: plugin.pluginName,
-				marketplaceName: CODEX_PLUGINS_MARKETPLACE_NAME,
-				...plugin.migrationBlock.apps ? { apps: plugin.migrationBlock.apps } : {},
-				...plugin.migrationBlock.error ? { error: plugin.migrationBlock.error } : {}
-			};
 			items.push(createMigrationItem({
 				id: `plugin:${sanitizeName(plugin.name) || sanitizeName(path.basename(plugin.source))}:${manualIndex}`,
 				kind: "manual",
@@ -2136,7 +2110,12 @@ function buildPluginItems(ctx, plugins) {
 				status: "skipped",
 				reason: plugin.migrationBlock.code,
 				message: plugin.message ?? `Codex native plugin "${plugin.name}" was found but not activated automatically.`,
-				details: { ...details }
+				details: {
+					pluginName: plugin.pluginName,
+					marketplaceName: CODEX_PLUGINS_MARKETPLACE_NAME,
+					...plugin.migrationBlock.apps ? { apps: plugin.migrationBlock.apps } : {},
+					...plugin.migrationBlock.error ? { error: plugin.migrationBlock.error } : {}
+				}
 			}));
 			continue;
 		}
@@ -2174,7 +2153,6 @@ function normalizeExistingAllowDestructiveActions(value) {
 	return asBoolean(value);
 }
 function readExistingPluginPolicyRepairs(config) {
-	if (config === void 0) return {};
 	return Object.fromEntries(Object.entries(readExistingCodexPluginEntries(config)).flatMap(([configKey, entry]) => {
 		const pluginEntry = isRecord(entry) ? entry : void 0;
 		if (pluginEntry?.allow_destructive_actions !== "on-request") return [];
@@ -2184,9 +2162,9 @@ function readExistingPluginPolicyRepairs(config) {
 		}]];
 	}));
 }
-function buildCodexPluginsConfigValue(entries, params = {}) {
+function buildCodexPluginsConfigValue(entries, config) {
 	const plugins = {
-		...readExistingPluginPolicyRepairs(params.config),
+		...readExistingPluginPolicyRepairs(config),
 		...Object.fromEntries(entries.toSorted((a, b) => a.configKey.localeCompare(b.configKey)).map((entry) => [entry.configKey, {
 			enabled: entry.enabled,
 			marketplaceName: CODEX_PLUGINS_MARKETPLACE_NAME,
@@ -2198,7 +2176,7 @@ function buildCodexPluginsConfigValue(entries, params = {}) {
 		enabled: true,
 		config: { codexPlugins: {
 			enabled: true,
-			allow_destructive_actions: params.config === void 0 ? true : readExistingAllowDestructiveActions(params.config) ?? true,
+			allow_destructive_actions: readExistingAllowDestructiveActions(config) ?? true,
 			plugins
 		} }
 	};
@@ -2225,7 +2203,7 @@ function hasCodexPluginConfigConflict(config, value) {
 function buildPluginConfigItem(ctx, pluginItems) {
 	const entries = pluginItems.filter((item) => item.status === "planned").map((item) => readCodexPluginMigrationConfigEntry(item, true)).filter((entry) => entry !== void 0);
 	if (entries.length === 0) return;
-	const value = buildCodexPluginsConfigValue(entries, { config: ctx.config });
+	const value = buildCodexPluginsConfigValue(entries, ctx.config);
 	const conflict = !ctx.overwrite && hasCodexPluginConfigConflict(ctx.config, value);
 	return createMigrationItem({
 		id: CODEX_PLUGIN_CONFIG_ITEM_ID,
@@ -2351,15 +2329,9 @@ async function applyCodexMigrationPlan(params) {
 	const targets = resolveCodexMigrationTargets(params.ctx);
 	const codexHome = typeof plan.metadata?.codexHome === "string" && plan.metadata.codexHome.trim() ? plan.metadata.codexHome : plan.source;
 	const authSource = {
-		root: plan.source,
-		confidence: "high",
 		codexHome,
 		authPath: path.join(codexHome, "auth.json"),
-		modelsCachePath: path.join(codexHome, "models_cache.json"),
-		memoryFiles: [],
-		skills: [],
-		plugins: [],
-		archivePaths: []
+		modelsCachePath: path.join(codexHome, "models_cache.json")
 	};
 	const runtime = withCachedMigrationConfigRuntime(params.ctx.runtime ?? params.runtime, params.ctx.config);
 	const applyCtx = {
@@ -2372,20 +2344,13 @@ async function applyCodexMigrationPlan(params) {
 			continue;
 		}
 		if (item.id === "config:codex-plugins") items.push(await applyCodexPluginConfigItem(applyCtx, item, items));
-		else if (item.kind === "auth") {
-			const authItem = await applyCodexAuthItem({
-				ctx: applyCtx,
-				item,
-				source: authSource,
-				targets
-			});
-			items.push(authItem);
-			items.push(...await buildCodexAuthConfigPatchItems({
-				ctx: applyCtx,
-				item: authItem,
-				source: authSource
-			}));
-		} else if (item.kind === "plugin" && item.action === "install") items.push(await applyCodexPluginInstallItem(applyCtx, item));
+		else if (item.kind === "auth") items.push(...await applyCodexAuthItems({
+			ctx: applyCtx,
+			item,
+			source: authSource,
+			targets
+		}));
+		else if (item.kind === "plugin" && item.action === "install") items.push(await applyCodexPluginInstallItem(applyCtx, item));
 		else if (item.kind === "manual") items.push(applyMigrationManualItem(item));
 		else if (item.action === "archive") items.push(await archiveMigrationItem(item, reportDir));
 		else if (item.kind === "memory") items.push(await copyMemoryMigrationFileItem(item, reportDir, {
@@ -2576,7 +2541,7 @@ async function applyCodexPluginConfigItem(ctx, item, appliedItems) {
 	const configApi = resolveMigrationConfigRuntime(ctx);
 	const currentConfig = returnPatch ? ctx.config : configApi?.current?.();
 	if (!currentConfig) return markMigrationItemError(item, "config runtime unavailable");
-	const value = buildCodexPluginsConfigValue(entries, { config: currentConfig });
+	const value = buildCodexPluginsConfigValue(entries, currentConfig);
 	if (!ctx.overwrite && hasCodexPluginConfigConflict(currentConfig, value)) return markMigrationItemConflict(item, MIGRATION_REASON_TARGET_EXISTS);
 	const migratedItem = {
 		...item,
@@ -2609,17 +2574,15 @@ function isCodexPluginConfigTerminal(item) {
 }
 function readAppliedPluginConfigEntry(item) {
 	if (item.status === "migrated" || item.deferredCompletion === true) return readCodexPluginMigrationConfigEntry(item, true);
-	if (item.status === "skipped" && item.reason !== CODEX_PLUGIN_NOT_SELECTED_REASON && item.reason === CODEX_PLUGIN_AUTH_REQUIRED_REASON) return readCodexPluginMigrationConfigEntry(item, false);
+	if (item.status === "skipped" && item.reason === CODEX_PLUGIN_AUTH_REQUIRED_REASON) return readCodexPluginMigrationConfigEntry(item, false);
 }
 function readCodexPluginPolicy(item) {
-	const configKey = item.details?.configKey;
-	const marketplaceName = item.details?.marketplaceName;
-	const pluginName = item.details?.pluginName;
-	if (typeof configKey !== "string" || marketplaceName !== "openai-curated" || typeof pluginName !== "string") return;
+	const entry = readCodexPluginMigrationConfigEntry(item, true);
+	if (!entry) return;
 	return {
-		configKey,
+		configKey: entry.configKey,
 		marketplaceName: CODEX_PLUGINS_MARKETPLACE_NAME,
-		pluginName,
+		pluginName: entry.pluginName,
 		enabled: true,
 		allowDestructiveActions: true,
 		destructiveApprovalMode: "allow"
@@ -2833,7 +2796,7 @@ function createCodexThreadsTool(options) {
 	return {
 		name: "codex_threads",
 		label: "Codex Threads",
-		description: "List and inspect native Codex threads. When supervision is enabled, raw transcript reads and every mutation require their matching supervision policy option.",
+		description: "Manage native Codex threads: list, read, fork, rename, archive (confirm:true), unarchive. When supervision is enabled, raw transcript reads and every mutation require their matching supervision policy option.",
 		parameters: CodexThreadsParamsSchema,
 		async execute(_toolCallId, rawParams) {
 			const params = asRecord$1(rawParams);
@@ -3758,7 +3721,7 @@ function createCodexSupervisionTools(options) {
 }
 //#endregion
 //#region extensions/codex/src/web-search-provider.ts
-const loadCodexWebSearchRuntime = createLazyRuntimeModule(() => import("./web-search-provider.runtime-Bx6HAc_k.js"));
+const loadCodexWebSearchRuntime = createLazyRuntimeModule(() => import("./web-search-provider.runtime-CCFhg2z5.js"));
 const CodexWebSearchSchema = {
 	type: "object",
 	properties: { query: {
@@ -3812,7 +3775,7 @@ var codex_default = definePluginEntry({
 				origin: "bundled",
 				config: normalizePluginsConfig(liveConfig.plugins),
 				rootConfig: liveConfig,
-				enabledByDefault: readCodexPluginConfig(livePluginConfig).supervision?.enabled === true
+				enabledByDefault: livePluginConfig !== void 0
 			}).enabled) return;
 			return livePluginConfig;
 		};
@@ -3948,7 +3911,7 @@ var codex_default = definePluginEntry({
 			if (!previousSessionId || !sessionId || previousSessionId === sessionId) return;
 			const config = resolveCurrentConfig();
 			const sessionKey = ctx.sessionKey?.trim();
-			const { sessionBindingIdentity } = await import("./session-binding-ZSMX1omP.js").then((n) => n.u);
+			const { sessionBindingIdentity } = await import("./session-binding-BXpo9ymA.js").then((n) => n.f);
 			const identity = sessionBindingIdentity({
 				sessionId,
 				...sessionKey ? { sessionKey } : {},
@@ -3964,8 +3927,9 @@ var codex_default = definePluginEntry({
 			const endedSessionKey = sessionKey?.trim();
 			const nextSessionKey = event.nextSessionKey?.trim();
 			if (endedSessionKey && nextSessionKey && nextSessionKey !== endedSessionKey) return;
+			if (event.nextSessionId?.trim() === event.sessionId.trim()) return;
 			const config = resolveCurrentConfig();
-			const { sessionBindingIdentity } = await import("./session-binding-ZSMX1omP.js").then((n) => n.u);
+			const { sessionBindingIdentity } = await import("./session-binding-BXpo9ymA.js").then((n) => n.f);
 			await bindingStore.retireSessionGeneration(sessionBindingIdentity({
 				sessionId: event.sessionId,
 				...sessionKey ? { sessionKey } : {},