@openclaw/codex 2026.7.2-beta.5 → 2026.7.2-beta.7

package/dist/{shared-client-BVKE40c-.js → shared-client-DTbvH-XV.js}

@@ -1,5 +1,5 @@
 import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
-import { d as codexAppServerStartOptionsKey, h as resolveCodexComputerUseConfig, m as resolveCodexAppServerStartOptionsForAgent, o as isCodexAppServerNativeAuthProfile, p as resolveCodexAppServerRuntimeOptions, x as resolveCodexAppServerUserHomeDir } from "./session-binding-DlVQ-Pxs.js";
+import { _ as resolveCodexAppServerStartOptionsForAgent, g as resolveCodexAppServerRuntimeOptions, o as isCodexAppServerNativeAuthProfile, p as codexAppServerStartOptionsKey, v as resolveCodexComputerUseConfig, w as resolveCodexAppServerUserHomeDir } from "./session-binding-BXpo9ymA.js";
 import { n as resolveCodexAppServerSpawnEnv, t as createStdioTransport } from "./transport-stdio-DXgGZ7Ib.js";
 import { createRequire } from "node:module";
 import fs, { access } from "node:fs/promises";
@@ -13,10 +13,10 @@ import fsSync, { constants, existsSync, readFileSync, realpathSync } from "node:
 import os from "node:os";
 import { isDeepStrictEqual } from "node:util";
 import { hasUsableOAuthCredential } from "openclaw/plugin-sdk/provider-auth";
+import { readSecretFile } from "openclaw/plugin-sdk/secret-file";
 import { runExec } from "openclaw/plugin-sdk/process-runtime";
 import { createInterface } from "node:readline";
 import { sliceUtf16Safe, truncateUtf16Safe } from "openclaw/plugin-sdk/text-utility-runtime";
-import { parse } from "semver";
 import { EventEmitter } from "node:events";
 import net from "node:net";
 import { PassThrough, Writable } from "node:stream";
@@ -417,10 +417,7 @@ function isRpcResponse(message) {
 //#endregion
 //#region extensions/codex/src/app-server/auth-bridge.ts
 const CODEX_APP_SERVER_AUTH_PROVIDER = "openai";
-const OPENAI_CODEX_APP_SERVER_AUTH_PROVIDER = "openai-codex";
-const LEGACY_CODEX_APP_SERVER_AUTH_PROVIDER = "codex-cli";
-const CODEX_APP_SERVER_EXTERNAL_CLI_PROVIDER_IDS = [CODEX_APP_SERVER_AUTH_PROVIDER, LEGACY_CODEX_APP_SERVER_AUTH_PROVIDER];
-const OPENAI_PROVIDER = "openai";
+const CODEX_APP_SERVER_EXTERNAL_CLI_PROVIDER_IDS = [CODEX_APP_SERVER_AUTH_PROVIDER];
 const OPENAI_CODEX_DEFAULT_PROFILE_ID = "openai:default";
 const CODEX_HOME_ENV_VAR = "CODEX_HOME";
 const HOME_ENV_VAR = "HOME";
@@ -454,8 +451,7 @@ async function bridgeCodexAppServerStartOptions(params) {
 			authProfileId: params.authProfileId,
 			store,
 			config: params.config
-		}),
-		config: params.config
+		})
 	}) ? withClearedEnvironmentVariables(scopedStartOptions, CODEX_APP_SERVER_API_KEY_ENV_VARS) : scopedStartOptions;
 }
 function resolveCodexAppServerAuthProfileId(params) {
@@ -512,7 +508,7 @@ async function resolveCodexAppServerPreparedAuthProfileSnapshot(params) {
 	});
 	if (!profileId) return;
 	const credential = store.profiles[profileId];
-	if (!credential || !isCodexAppServerAuthProfileCredential(credential, params.config)) return;
+	if (!credential || !isCodexAppServerAuthProfileCredential(credential)) return;
 	const loginParams = await resolveCodexAppServerAuthProfileLoginParamsInternal({
 		agentDir,
 		authProfileId: profileId,
@@ -586,7 +582,7 @@ async function resolveCodexAppServerAuthAccountCacheKey(params) {
 	});
 	if (!profileId) return;
 	const credential = store.profiles[profileId];
-	if (!credential || !isCodexAppServerAuthProfileCredential(credential, params.config)) return;
+	if (!credential || !isCodexAppServerAuthProfileCredential(credential)) return;
 	if (credential.type === "api_key") {
 		const apiKey = (await resolveApiKeyForProfile({
 			store,
@@ -697,10 +693,7 @@ async function applyCodexAppServerAuthProfile(params) {
 		return;
 	}
 	if (params.authProfileId === null) {
-		if (params.authRequirement === "subscription") {
-			const response = await params.client.request("account/read", { refreshToken: false });
-			if (!isJsonObject$1(response.account) || response.account.type !== "chatgpt") throw createCodexAppServerAuthError("Codex subscription auth profile could not produce login credentials.");
-		}
+		await assertNativeCodexAccountMatchesRoute(params.client, params.authRequirement);
 		return;
 	}
 	let loginParams;
@@ -730,6 +723,23 @@ async function applyCodexAppServerAuthProfile(params) {
 	}
 	await params.client.request("account/login/start", loginParams);
 }
+/**
+* Native-home connections are verified, never logged into. Both directions of the
+* check protect the same billing boundary: a subscription route cannot run without
+* ChatGPT tokens, and a Platform route must not silently spend the operator's
+* ChatGPT plan. An absent account is left alone because the native home may serve a
+* custom model provider that reports no OpenAI account at all.
+*/
+async function assertNativeCodexAccountMatchesRoute(client, authRequirement) {
+	if (!authRequirement) return;
+	const response = await client.request("account/read", { refreshToken: false });
+	const accountType = isJsonObject$1(response.account) ? response.account.type : void 0;
+	if (authRequirement === "subscription") {
+		if (accountType !== "chatgpt") throw createCodexAppServerAuthError("Codex subscription auth profile could not produce login credentials.");
+		return;
+	}
+	if (accountType === "chatgpt") throw createCodexAppServerAuthError("Codex Platform route requires an API-key account, but the native Codex home is signed in with a ChatGPT subscription. Sign that home in with `codex login --with-api-key`, or set appServer.homeScope=\"agent\" so OpenClaw can inject its own key.");
+}
 function createCodexAppServerAuthError(message, cause) {
 	const error = cause === void 0 ? new Error(message) : new Error(message, { cause });
 	return Object.assign(error, { status: 401 });
@@ -744,7 +754,7 @@ async function resolveCodexAppServerAuthProfileLoginParams(params) {
 	});
 	const profile = profileId ? store.profiles[profileId] : void 0;
 	if (profileId && !profile) throw new CodexAppServerAuthProfileUnavailableError(`Codex app-server auth profile "${profileId}" was not found.`);
-	if (profileId && profile && !isCodexAppServerAuthProfileCredential(profile, params.config)) throw new CodexAppServerAuthProfileUnavailableError(`Codex app-server auth profile "${profileId}" must be OpenAI Codex auth or an OpenAI API-key backup.`);
+	if (profileId && profile && !isCodexAppServerAuthProfileCredential(profile)) throw new CodexAppServerAuthProfileUnavailableError(`Codex app-server auth profile "${profileId}" must use the canonical OpenAI auth provider; run "openclaw doctor --fix" to migrate legacy provider IDs.`);
 	return await resolveCodexAppServerAuthProfileLoginParamsInternal({
 		...params,
 		authProfileStore: store
@@ -777,7 +787,7 @@ async function resolveCodexAppServerAuthProfileLoginParamsInternal(params) {
 	if (!profileId) return;
 	const credential = store.profiles[profileId];
 	if (!credential) throw new Error(`Codex app-server auth profile "${profileId}" was not found.`);
-	if (!isCodexAppServerAuthProfileCredential(credential, params.config)) throw new Error(`Codex app-server auth profile "${profileId}" must be OpenAI Codex auth or an OpenAI API-key backup.`);
+	if (!isCodexAppServerAuthProfileCredential(credential)) throw new Error(`Codex app-server auth profile "${profileId}" must use the canonical OpenAI auth provider; run "openclaw doctor --fix" to migrate legacy provider IDs.`);
 	const loginParams = await resolveLoginParamsForCredential(profileId, credential, {
 		agentDir: params.agentDir,
 		store,
@@ -823,7 +833,7 @@ function parseCodexCliAuthFileApiKey(raw) {
 }
 async function readCodexCliAuthFileApiKey(env) {
 	try {
-		return parseCodexCliAuthFileApiKey(await fs.readFile(resolveCodexCliAuthFilePath(env), "utf8"));
+		return parseCodexCliAuthFileApiKey(await readSecretFile(resolveCodexCliAuthFilePath(env), "Codex CLI auth file"));
 	} catch {
 		return;
 	}
@@ -888,9 +898,9 @@ async function resolveOAuthCredentialForCodexAppServer(profileId, credential, pa
 		authProfileId: profileId,
 		config: params.config
 	});
-	const persistedOAuthCredential = !useScopedCredential && persistedCredential?.type === "oauth" && isCodexAppServerAuthProvider(persistedCredential.provider, params.config) ? persistedCredential : void 0;
+	const persistedOAuthCredential = !useScopedCredential && persistedCredential?.type === "oauth" && isCodexAppServerAuthProvider(persistedCredential.provider) ? persistedCredential : void 0;
 	const ownerCredential = store.profiles[profileId];
-	const overlaidOAuthCredential = ownerCredential?.type === "oauth" && isCodexAppServerAuthProvider(ownerCredential.provider, params.config) ? ownerCredential : void 0;
+	const overlaidOAuthCredential = ownerCredential?.type === "oauth" && isCodexAppServerAuthProvider(ownerCredential.provider) ? ownerCredential : void 0;
 	if (useScopedCredential && overlaidOAuthCredential) return await resolveScopedOAuthCredential({
 		store,
 		profileId,
@@ -910,10 +920,10 @@ async function resolveOAuthCredentialForCodexAppServer(profileId, credential, pa
 		forceRefresh: params.forceRefresh && Boolean(persistedOAuthCredential)
 	});
 	const refreshed = useScopedCredential ? void 0 : loadAuthProfileStoreForSecretsRuntime(ownerAgentDir).profiles[profileId];
-	const refreshedOAuthCredential = refreshed?.type === "oauth" && isCodexAppServerAuthProvider(refreshed.provider, params.config) ? refreshed : void 0;
+	const refreshedOAuthCredential = refreshed?.type === "oauth" && isCodexAppServerAuthProvider(refreshed.provider) ? refreshed : void 0;
 	if (refreshedOAuthCredential && isDeepStrictEqual(params.store.profiles[profileId], credential)) params.store.profiles[profileId] = refreshedOAuthCredential;
 	const storedCredential = store.profiles[profileId];
-	const candidate = refreshedOAuthCredential ? refreshedOAuthCredential : storedCredential?.type === "oauth" && isCodexAppServerAuthProvider(storedCredential.provider, params.config) ? storedCredential : credential;
+	const candidate = refreshedOAuthCredential ? refreshedOAuthCredential : storedCredential?.type === "oauth" && isCodexAppServerAuthProvider(storedCredential.provider) ? storedCredential : credential;
 	return resolved?.apiKey ? {
 		...candidate,
 		access: resolved.apiKey
@@ -957,22 +967,18 @@ async function resolveScopedOAuthCredential(params) {
 		if (storeRefreshes.get(params.profileId) === refresh) storeRefreshes.delete(params.profileId);
 	}
 }
-function isCodexAppServerAuthProvider(provider, config) {
-	const resolvedProvider = resolveProviderIdForAuth(provider, { config });
-	return resolvedProvider === CODEX_APP_SERVER_AUTH_PROVIDER || resolvedProvider === OPENAI_CODEX_APP_SERVER_AUTH_PROVIDER || resolvedProvider === LEGACY_CODEX_APP_SERVER_AUTH_PROVIDER;
-}
-function isOpenAIApiKeyBackupCredential(credential, config) {
-	return credential.type === "api_key" && resolveProviderIdForAuth(credential.provider, { config }) === OPENAI_PROVIDER;
+function isCodexAppServerAuthProvider(provider) {
+	return provider.trim().toLowerCase() === CODEX_APP_SERVER_AUTH_PROVIDER;
 }
-function isCodexAppServerAuthProfileCredential(credential, config) {
-	return isCodexAppServerAuthProvider(credential.provider, config) || isOpenAIApiKeyBackupCredential(credential, config);
+function isCodexAppServerAuthProfileCredential(credential) {
+	return isCodexAppServerAuthProvider(credential.provider);
 }
 function shouldClearOpenAiApiKeyForCodexAuthProfile(params) {
 	const profileId = params.authProfileId?.trim();
-	return isCodexSubscriptionCredential(profileId ? params.store.profiles[profileId] : params.store.profiles[OPENAI_CODEX_DEFAULT_PROFILE_ID], params.config);
+	return isCodexSubscriptionCredential(profileId ? params.store.profiles[profileId] : params.store.profiles[OPENAI_CODEX_DEFAULT_PROFILE_ID]);
 }
-function isCodexSubscriptionCredential(credential, config) {
-	if (!credential || !isCodexAppServerAuthProvider(credential.provider, config)) return false;
+function isCodexSubscriptionCredential(credential) {
+	if (!credential || !isCodexAppServerAuthProvider(credential.provider)) return false;
 	return credential.type === "oauth" || credential.type === "token";
 }
 function withClearedEnvironmentVariables(startOptions, envVars) {
@@ -1144,6 +1150,39 @@ function ensureCodexAppServerClientRuntime(client, context) {
 		if (notification.method === "account/rateLimits/updated") mergeCodexRateLimitsUpdate(client, notification.params);
 	});
 }
+/** Keep at most one idle, still-subscribed thread on a physical Codex client. */
+async function retainCodexAppServerLiveThread(client, threadId, releasePreviousThread, configFingerprint) {
+	const runtime = configuredClients.get(client);
+	if (!runtime) return;
+	if (runtime.retainedThreadRelease) await runtime.retainedThreadRelease;
+	const previousThreadId = runtime.retainedThreadId;
+	if (previousThreadId && previousThreadId !== threadId && releasePreviousThread) {
+		const release = releasePreviousThread(previousThreadId);
+		runtime.retainedThreadRelease = release;
+		try {
+			await release;
+		} catch (error) {
+			runtime.retainedThreadId = void 0;
+			runtime.retainedThreadConfigFingerprint = void 0;
+			throw error;
+		} finally {
+			if (runtime.retainedThreadRelease === release) runtime.retainedThreadRelease = void 0;
+		}
+	}
+	runtime.retainedThreadId = threadId;
+	runtime.retainedThreadConfigFingerprint = configFingerprint;
+	return previousThreadId ? { previousThreadId } : {};
+}
+/** A warm turn can skip resume only when this exact subscription was retained. */
+async function consumeCodexAppServerLiveThread(client, threadId, configFingerprint) {
+	const runtime = configuredClients.get(client);
+	if (!runtime) return false;
+	if (runtime.retainedThreadRelease) await runtime.retainedThreadRelease;
+	if (runtime.retainedThreadId !== threadId || configFingerprint !== void 0 && runtime.retainedThreadConfigFingerprint !== configFingerprint) return false;
+	runtime.retainedThreadId = void 0;
+	runtime.retainedThreadConfigFingerprint = void 0;
+	return true;
+}
 //#endregion
 //#region extensions/codex/src/app-server/transport-websocket.ts
 /**
@@ -1309,10 +1348,8 @@ function signalCodexAppServerTransport(child, signal) {
 /**
 * Version and package pins for the managed Codex app-server runtime.
 */
-/** Minimum Codex app-server version supported by the OpenClaw Codex bridge. */
-const MIN_CODEX_APP_SERVER_VERSION = "0.143.0";
-/** Newest Codex app-server version validated by the OpenClaw Codex bridge. */
-const MAX_CODEX_APP_SERVER_VERSION = "0.145.0";
+/** Exact Codex app-server version shipped and supported by the OpenClaw Codex bridge. */
+const CODEX_APP_SERVER_VERSION = "0.146.0";
 /** npm package name for the managed Codex app-server binary. */
 const MANAGED_CODEX_APP_SERVER_PACKAGE = "@openai/codex";
 //#endregion
@@ -1321,7 +1358,6 @@ const MANAGED_CODEX_APP_SERVER_PACKAGE = "@openai/codex";
 * JSON-RPC client for Codex app-server transports, including request/response
 * routing, notification fanout, server request handlers, and version checks.
 */
-/** Minimum supported Codex app-server version exported for callers/tests. */
 const CODEX_APP_SERVER_PARSE_LOG_MAX = 500;
 const CODEX_APP_SERVER_PARSE_BUFFER_MAX = 8 * 1024 * 1024;
 const CODEX_APP_SERVER_PARSE_BUFFER_MAX_LINES = 1e3;
@@ -1491,6 +1527,10 @@ var CodexAppServerClient = class CodexAppServerClient {
 	getRuntimeIdentity() {
 		return this.runtimeIdentity ? { ...this.runtimeIdentity } : void 0;
 	}
+	/** Returns a bounded, redacted stderr diagnostic from the app-server process. */
+	getStderrDiagnostic() {
+		return redactCodexAppServerLinePreview(this.stderrTail) || void 0;
+	}
 	/** Stable generation id for this exact physical client instance. */
 	getInstanceId() {
 		return this.instanceId;
@@ -1876,9 +1916,13 @@ var CodexAppServerClient = class CodexAppServerClient {
 		}
 	}
 	handleNotification(notification) {
-		for (const handler of this.notificationHandlers) Promise.resolve(handler(notification)).catch((error) => {
+		for (const handler of this.notificationHandlers) try {
+			Promise.resolve(handler(notification)).catch((error) => {
+				embeddedAgentLog.warn("codex app-server notification handler failed", { error });
+			});
+		} catch (error) {
 			embeddedAgentLog.warn("codex app-server notification handler failed", { error });
-		});
+		}
 	}
 	closeWithError(error) {
 		if (this.markClosed(error)) closeCodexAppServerTransport(this.child);
@@ -1934,15 +1978,14 @@ function timeoutServerRequestResponse(request) {
 var CodexAppServerVersionError = class extends Error {
 	constructor(detectedVersion) {
 		const detected = detectedVersion ? `detected ${detectedVersion}` : "OpenClaw could not determine the running Codex version";
-		super(`A stable Codex app-server from ${MIN_CODEX_APP_SERVER_VERSION} through ${MAX_CODEX_APP_SERVER_VERSION} is required, but ${detected}. Update the configured Codex app-server binary, or remove custom command overrides to use the managed binary.`);
+		super(`Codex app-server ${CODEX_APP_SERVER_VERSION} is required, but ${detected}. Update the configured Codex app-server binary, or remove custom command overrides to use the managed binary.`);
 		this.name = "CodexAppServerVersionError";
 		this.detectedVersion = detectedVersion;
 	}
 };
 function assertSupportedCodexAppServerVersion(response) {
 	const detectedVersion = readCodexVersionFromUserAgent(response.userAgent);
-	const parsedVersion = parse(detectedVersion ?? "");
-	if (!detectedVersion || !parsedVersion || parsedVersion.compare("0.143.0") < 0 || parsedVersion.compare("0.145.0") > 0 || parsedVersion.prerelease.length > 0 || parsedVersion.build.length > 0) throw new CodexAppServerVersionError(detectedVersion);
+	if (detectedVersion !== "0.146.0") throw new CodexAppServerVersionError(detectedVersion);
 	return detectedVersion;
 }
 function isUnsupportedCodexAppServerVersionError(error) {
@@ -2309,10 +2352,12 @@ var shared_client_exports = /* @__PURE__ */ __exportAll({
 	releaseLeasedSharedCodexAppServerClient: () => releaseLeasedSharedCodexAppServerClient,
 	resolveCodexAppServerSpawnIdentity: () => resolveCodexAppServerSpawnIdentity,
 	resolveCodexNativeConfigFenceKey: () => resolveCodexNativeConfigFenceKey,
+	retainSharedCodexAppServerClientByInstanceId: () => retainSharedCodexAppServerClientByInstanceId,
 	retainSharedCodexAppServerClientIfCurrent: () => retainSharedCodexAppServerClientIfCurrent,
 	retireSharedCodexAppServerClientIfCurrent: () => retireSharedCodexAppServerClientIfCurrent,
 	withLeasedCodexAppServerClientStartSelectionRetry: () => withLeasedCodexAppServerClientStartSelectionRetry
 });
+const CODEX_APP_SERVER_INITIALIZE_TIMEOUT_MESSAGE = "codex app-server initialize timed out";
 const suspectClosedClients = /* @__PURE__ */ new WeakSet();
 const SHARED_CODEX_APP_SERVER_CLIENT_STATE = Symbol.for("openclaw.codexAppServerClientState");
 const SHARED_CODEX_APP_SERVER_CLIENT_DISPOSER = Symbol.for("openclaw.codexAppServerClientDisposer");
@@ -2444,6 +2489,44 @@ async function resolveCodexAppServerClientStartContext(options) {
 		})
 	};
 }
+function resolveWarmSharedCodexAppServerClientIdentity(options) {
+	if (!options?.config || typeof options.config !== "object" || !options.startOptions || options.pluginConfig !== void 0 || options.authProfileStore !== void 0 || options.preparedAuth !== void 0 || options.runtimeArtifactMode !== void 0 || options.expectedRuntimeArtifact !== void 0) return;
+	const authProfileSelector = options.authProfileId === null ? ["native"] : options.authProfileId === void 0 ? ["implicit"] : ["profile", options.authProfileId];
+	return {
+		config: options.config,
+		startOptions: options.startOptions,
+		selectorKey: JSON.stringify([
+			options.agentDir ?? resolveDefaultAgentDir(options.config),
+			authProfileSelector,
+			options.authBindingFingerprint ?? null,
+			options.authRequirement ?? null
+		])
+	};
+}
+function readWarmSharedCodexAppServerClient(state, identity) {
+	const aliases = state.warmClientsByConfig?.get(identity.config)?.get(identity.startOptions);
+	const warm = aliases?.get(identity.selectorKey);
+	if (!warm) return;
+	if (state.clients.get(warm.key) !== warm.entry || warm.entry.client !== warm.client || warm.entry.closeWhenIdle || warm.entry.closeError) {
+		aliases?.delete(identity.selectorKey);
+		return;
+	}
+	return warm;
+}
+function rememberWarmSharedCodexAppServerClient(state, identity, warm) {
+	state.warmClientsByConfig ??= /* @__PURE__ */ new WeakMap();
+	let byStartOptions = state.warmClientsByConfig.get(identity.config);
+	if (!byStartOptions) {
+		byStartOptions = /* @__PURE__ */ new WeakMap();
+		state.warmClientsByConfig.set(identity.config, byStartOptions);
+	}
+	let aliases = byStartOptions.get(identity.startOptions);
+	if (!aliases) {
+		aliases = /* @__PURE__ */ new Map();
+		byStartOptions.set(identity.startOptions, aliases);
+	}
+	aliases.set(identity.selectorKey, warm);
+}
 /** Gets or starts a shared Codex app-server client without retaining a lease. */
 async function getSharedCodexAppServerClient(options) {
 	return (await acquireSharedCodexAppServerClient(options)).client;
@@ -2513,6 +2596,17 @@ async function withLeasedCodexAppServerClientStartSelectionRetry(params) {
 }
 async function acquireSharedCodexAppServerClient(options, leaseOptions) {
 	if (options?.abandonSignal?.aborted) throw new CodexAppServerStartupError("aborted", "codex app-server initialize aborted");
+	const state = getSharedCodexAppServerClientState();
+	const warmIdentity = resolveWarmSharedCodexAppServerClientIdentity(options);
+	const warmClient = warmIdentity ? readWarmSharedCodexAppServerClient(state, warmIdentity) : void 0;
+	if (warmClient) {
+		options?.onStartedClient?.(warmClient.client);
+		const release = leaseOptions?.leased ? retainSharedClientEntry(warmClient.entry) : void 0;
+		return release ? {
+			client: warmClient.client,
+			release
+		} : { client: warmClient.client };
+	}
 	const acquireStartedAt = Date.now();
 	const timeoutMs = options?.timeoutMs ?? 0;
 	const { agentDir, usesNativeAuth, authProfileId, authProfileStore, preparedAuth, authRequirement, requestedStartOptions, startOptions } = await withCodexAppServerAcquireDeadline(timeoutMs, resolveCodexAppServerClientStartContext(options), options?.abandonSignal);
@@ -2527,7 +2621,7 @@ async function acquireSharedCodexAppServerClient(options, leaseOptions) {
 	const runtimeArtifactMode = options?.runtimeArtifactMode ?? (options?.expectedRuntimeArtifact ? "capture" : void 0);
 	const expectedRuntimeArtifactKey = options?.expectedRuntimeArtifact ? createHash("sha256").update(options.expectedRuntimeArtifact.id).update("\0").update(options.expectedRuntimeArtifact.fingerprint).digest("hex") : "mint";
 	const key = runtimeArtifactMode ? `${baseKey}\0runtime-artifact:capture-v1:${expectedRuntimeArtifactKey}` : baseKey;
-	const entry = getOrCreateSharedClientEntry(getSharedCodexAppServerClientState(), key);
+	const entry = getOrCreateSharedClientEntry(state, key);
 	if (runtimeArtifactMode) entry.runtimeArtifactStartupAbort ??= new AbortController();
 	entry.closeWhenIdle = false;
 	const releasePendingAcquire = retainPendingSharedClientAcquire(entry);
@@ -2566,7 +2660,7 @@ async function acquireSharedCodexAppServerClient(options, leaseOptions) {
 		config: options?.config
 	}));
 	try {
-		await withCodexAppServerAcquireDeadline(remainingTimeoutMs, startup.initialized, options?.abandonSignal);
+		await withCodexAppServerAcquireDeadline(remainingTimeoutMs, startup.initialized, options?.abandonSignal, CODEX_APP_SERVER_INITIALIZE_TIMEOUT_MESSAGE, () => buildCodexAppServerInitializeTimeoutError(entry.client));
 		const client = await withCodexAppServerAcquireDeadline(timeoutMs, startup.ready, options?.abandonSignal, "codex app-server authentication timed out");
 		if (entry.closeError) throw entry.closeError;
 		ensureCodexAppServerClientRuntime(client, {
@@ -2577,6 +2671,11 @@ async function acquireSharedCodexAppServerClient(options, leaseOptions) {
 			config: options?.config
 		});
 		const release = leaseOptions?.leased ? retainSharedClientEntry(entry) : void 0;
+		if (warmIdentity) rememberWarmSharedCodexAppServerClient(state, warmIdentity, {
+			key,
+			entry,
+			client
+		});
 		return release ? {
 			client,
 			release
@@ -2591,9 +2690,9 @@ async function acquireSharedCodexAppServerClient(options, leaseOptions) {
 		releasePendingAcquire();
 	}
 }
-async function withCodexAppServerAcquireDeadline(timeoutMs, promise, signal, timeoutMessage = "codex app-server initialize timed out") {
+async function withCodexAppServerAcquireDeadline(timeoutMs, promise, signal, timeoutMessage = CODEX_APP_SERVER_INITIALIZE_TIMEOUT_MESSAGE, timeoutErrorFactory) {
 	if (signal?.aborted) throw new CodexAppServerStartupError("aborted", "codex app-server initialize aborted");
-	const timed = withTimeout$1(promise, timeoutMs, timeoutMessage, () => new CodexAppServerStartupError("timed_out", timeoutMessage));
+	const timed = withTimeout$1(promise, timeoutMs, timeoutMessage, () => timeoutErrorFactory?.() ?? new CodexAppServerStartupError("timed_out", timeoutMessage));
 	if (!signal) return await timed;
 	return await new Promise((resolve, reject) => {
 		const onAbort = () => reject(new CodexAppServerStartupError("aborted", "codex app-server initialize aborted"));
@@ -2601,6 +2700,10 @@ async function withCodexAppServerAcquireDeadline(timeoutMs, promise, signal, tim
 		timed.then(resolve, reject).finally(() => signal.removeEventListener("abort", onAbort));
 	});
 }
+function buildCodexAppServerInitializeTimeoutError(client) {
+	const stderr = client?.getStderrDiagnostic();
+	return new CodexAppServerStartupError("timed_out", stderr ? `${CODEX_APP_SERVER_INITIALIZE_TIMEOUT_MESSAGE}; stderr=${JSON.stringify(stderr)}` : CODEX_APP_SERVER_INITIALIZE_TIMEOUT_MESSAGE);
+}
 function resolveRemainingAcquireTimeout(timeoutMs, startedAt) {
 	if (!(timeoutMs > 0)) return timeoutMs;
 	const remaining = timeoutMs - (Date.now() - startedAt);
@@ -2669,7 +2772,7 @@ async function startInitializedCodexAppServerClient(params) {
 	const timeoutMs = params.timeoutMs ?? 0;
 	const startOptionsCandidates = resolveManagedFallbackStartOptions(params.startOptions);
 	for (const [index, startOptions] of startOptionsCandidates.entries()) {
-		const runtimeArtifactModule = params.runtimeArtifactMode ? await import("./runtime-artifact-C2ITXdhM.js") : void 0;
+		const runtimeArtifactModule = params.runtimeArtifactMode ? await import("./runtime-artifact-CmtG_t1L.js") : void 0;
 		const nativeCommandBeforeStart = startOptions.commandSource === "resolved-managed" ? resolveManagedCodexNativeCommand(startOptions.command) : void 0;
 		const runtimeArtifactBeforeStart = runtimeArtifactModule ? await runtimeArtifactModule.captureCodexAppServerRuntimeArtifactBeforeStart({
 			startOptions,
@@ -2684,7 +2787,7 @@ async function startInitializedCodexAppServerClient(params) {
 		params.onStartedClient?.(client);
 		let initialize;
 		try {
-			await withCodexAppServerAcquireDeadline(resolveRemainingAcquireTimeout(timeoutMs, acquireStartedAt), initialize = client.initialize(), params.abandonSignal);
+			await withCodexAppServerAcquireDeadline(resolveRemainingAcquireTimeout(timeoutMs, acquireStartedAt), initialize = client.initialize(), params.abandonSignal, CODEX_APP_SERVER_INITIALIZE_TIMEOUT_MESSAGE, () => buildCodexAppServerInitializeTimeoutError(client));
 		} catch (error) {
 			client.close();
 			initialize?.catch(() => void 0);
@@ -2789,6 +2892,19 @@ function retainSharedCodexAppServerClientIfCurrent(client) {
 	const state = getSharedCodexAppServerClientState();
 	for (const entry of state.clients.values()) if (entry.client === client) return retainSharedClientEntry(entry);
 }
+/** Retains the live shared client whose initialized instance id matches a thread binding. */
+function retainSharedCodexAppServerClientByInstanceId(clientId) {
+	const normalizedClientId = clientId?.trim();
+	if (!normalizedClientId) return;
+	for (const entry of getSharedCodexAppServerClientState().clients.values()) {
+		const client = entry.client;
+		if (client?.getInstanceId() !== normalizedClientId || entry.closeWhenIdle || entry.closeError) continue;
+		return {
+			client,
+			release: retainSharedClientEntry(entry)
+		};
+	}
+}
 /**
 * Retires a matching shared client. Default is graceful: detach from the map
 * (future acquisitions get a fresh client) and close once leases drain.
@@ -2851,6 +2967,7 @@ async function clearSharedCodexAppServerClientAndWait(options) {
 	const state = getSharedCodexAppServerClientState();
 	const clients = collectSharedClients(state);
 	state.clients.clear();
+	state.warmClientsByConfig = /* @__PURE__ */ new WeakMap();
 	await Promise.all(clients.map((client) => client.closeAndWait(options)));
 }
 globalThis[SHARED_CODEX_APP_SERVER_CLIENT_DISPOSER] = clearSharedCodexAppServerClientAndWait;
@@ -2949,4 +3066,4 @@ function collectSharedClients(state) {
 	return [...new Set([...state.clients.values()].map((entry) => entry.client).filter((client) => Boolean(client)))];
 }
 //#endregion
-export { withCodexStartupTimeout as $, rememberCodexRateLimitsRead as A, flattenCodexDynamicToolFunctions as B, isCodexAppServerIndeterminateTransportError as C, ensureCodexAppServerClientRuntime as D, resolveCodexAppServerClientInstanceId as E, resolveCodexAppServerPreparedApiKeyCacheKey as F, CodexAppServerStartupError as G, resolveFirstExistingMacOSDesktopCodexBundledMarketplacePath as H, resolveCodexAppServerPreparedAuthHandoff as I, resolveCodexPostToolRawAssistantCompletionIdleTimeoutMs as J, isCodexAppServerStartupError as K, CODEX_INTERACTIVE_CUSTOM_THREAD_SOURCES as L, resolveCodexAppServerAuthProfileId as M, resolveCodexAppServerAuthProfileIdForAgent as N, readCodexRateLimitsRevision as O, resolveCodexAppServerFallbackApiKeyCacheKey as P, resolveCodexTurnTerminalIdleTimeoutMs as Q, CODEX_INTERACTIVE_THREAD_SOURCE_KINDS as R, isCodexAppServerIndeterminateRequestCancellationError as S, isCodexAppServerRequestTimeoutError as T, resolveCodexAppServerHomeDir as U, isJsonObject$1 as V, CODEX_POST_REASONING_REPLY_IDLE_TIMEOUT_MS as W, resolveCodexTurnAssistantCompletionIdleTimeoutMs as X, resolveCodexStartupTimeoutMs as Y, resolveCodexTurnCompletionIdleTimeoutMs as Z, CodexAppServerRpcError as _, getLeasedSharedCodexAppServerClient as a, isCodexAppServerBrokenPipeError as b, releaseCodexAppServerClientLease as c, retainSharedCodexAppServerClientIfCurrent as d, retireSharedCodexAppServerClientIfCurrent as f, acquireCodexNativeConfigFence as g, withTimeout$1 as h, createIsolatedCodexAppServerClient as i, resolveCodexAppServerAuthAccountCacheKey as j, readRecentCodexRateLimits as k, releaseLeasedSharedCodexAppServerClient as l, withLeasedCodexAppServerClientStartSelectionRetry as m, clearSharedCodexAppServerClientIfCurrentAndUnclaimed as n, getSharedCodexAppServerClient as o, shared_client_exports as p, resolveCodexGatewayTimeoutWithGraceMs as q, clearSharedCodexAppServerClientIfCurrentAndWait as r, isCodexAppServerStartSelectionChangedError as s, clearSharedCodexAppServerClientIfCurrent as t, resolveCodexNativeConfigFenceKey as u, getCodexAppServerClientInstanceId as v, isCodexAppServerPrewriteRequestCancellationError as w, isCodexAppServerConnectionClosedError as x, isCodexAppServerApprovalRequest as y, CODEX_OPENCLAW_DIRECT_DYNAMIC_TOOL_NAMESPACE as z };
+export { resolveCodexTurnAssistantCompletionIdleTimeoutMs as $, retainCodexAppServerLiveThread as A, CODEX_INTERACTIVE_CUSTOM_THREAD_SOURCES as B, isCodexAppServerIndeterminateRequestCancellationError as C, resolveCodexAppServerClientInstanceId as D, isCodexAppServerRequestTimeoutError as E, resolveCodexAppServerAuthProfileId as F, resolveFirstExistingMacOSDesktopCodexBundledMarketplacePath as G, CODEX_OPENCLAW_DIRECT_DYNAMIC_TOOL_NAMESPACE as H, resolveCodexAppServerAuthProfileIdForAgent as I, CodexAppServerStartupError as J, resolveCodexAppServerHomeDir as K, resolveCodexAppServerFallbackApiKeyCacheKey as L, readRecentCodexRateLimits as M, rememberCodexRateLimitsRead as N, consumeCodexAppServerLiveThread as O, resolveCodexAppServerAuthAccountCacheKey as P, resolveCodexStartupTimeoutMs as Q, resolveCodexAppServerPreparedApiKeyCacheKey as R, isCodexAppServerConnectionClosedError as S, isCodexAppServerPrewriteRequestCancellationError as T, flattenCodexDynamicToolFunctions as U, CODEX_INTERACTIVE_THREAD_SOURCE_KINDS as V, isJsonObject$1 as W, resolveCodexGatewayTimeoutWithGraceMs as X, isCodexAppServerStartupError as Y, resolveCodexPostToolRawAssistantCompletionIdleTimeoutMs as Z, acquireCodexNativeConfigFence as _, getLeasedSharedCodexAppServerClient as a, isCodexAppServerApprovalRequest as b, releaseCodexAppServerClientLease as c, retainSharedCodexAppServerClientByInstanceId as d, resolveCodexTurnCompletionIdleTimeoutMs as et, retainSharedCodexAppServerClientIfCurrent as f, withTimeout$1 as g, withLeasedCodexAppServerClientStartSelectionRetry as h, createIsolatedCodexAppServerClient as i, readCodexRateLimitsRevision as j, ensureCodexAppServerClientRuntime as k, releaseLeasedSharedCodexAppServerClient as l, shared_client_exports as m, clearSharedCodexAppServerClientIfCurrentAndUnclaimed as n, withCodexStartupTimeout as nt, getSharedCodexAppServerClient as o, retireSharedCodexAppServerClientIfCurrent as p, CODEX_POST_REASONING_REPLY_IDLE_TIMEOUT_MS as q, clearSharedCodexAppServerClientIfCurrentAndWait as r, isCodexAppServerStartSelectionChangedError as s, clearSharedCodexAppServerClientIfCurrent as t, resolveCodexTurnTerminalIdleTimeoutMs as tt, resolveCodexNativeConfigFenceKey as u, CodexAppServerRpcError as v, isCodexAppServerIndeterminateTransportError as w, isCodexAppServerBrokenPipeError as x, getCodexAppServerClientInstanceId as y, resolveCodexAppServerPreparedAuthHandoff as z };

package/dist/{side-question-CO12sHxo.js → side-question-_ulBk1AL.js}

@@ -1,12 +1,12 @@
-import { D as ensureCodexAppServerClientRuntime, I as resolveCodexAppServerPreparedAuthHandoff, V as isJsonObject, a as getLeasedSharedCodexAppServerClient, c as releaseCodexAppServerClientLease, k as readRecentCodexRateLimits, m as withLeasedCodexAppServerClientStartSelectionRetry, y as isCodexAppServerApprovalRequest } from "./shared-client-BVKE40c-.js";
-import { D as resolveOpenClawExecPolicyForCodexAppServer, S as resolveCodexModelBackedReviewerPolicyContext, T as readCodexPluginConfig, b as canUseCodexModelBackedApprovalsReviewerForModel, l as sessionBindingIdentity, v as shouldAutoApproveCodexAppServerApprovals } from "./session-binding-DlVQ-Pxs.js";
-import { A as resolveCodexDynamicToolsLoading, C as readCodexSupportedReasoningEfforts, G as mergeCodexThreadConfigs, S as resolveReasoningEffort, T as filterCodexDynamicTools, V as buildCodexPluginAppsConfigPatchFromPolicyContext, _ as CODEX_NATIVE_PERSONALITY_NONE, f as buildCodexRuntimeThreadConfig, h as resolveCodexWebSearchPlan, v as resolveCodexAppServerModelProvider, x as resolveCodexBindingModelProviderFallback, y as resolveCodexAppServerRequestModelSelection } from "./thread-lifecycle-DRg_FdzC.js";
-import { a as assertCodexTurnStartResponse, l as readCodexTurn, n as assertCodexThreadForkResponse, o as readCodexDynamicToolCallParams } from "./protocol-validators-Dm4eXZmt.js";
-import { n as formatCodexUsageLimitErrorMessage } from "./rate-limits-S_PXs0ul.js";
-import { t as resolveCodexAppServerForModelProvider } from "./app-server-policy-BmDgseo_.js";
-import { n as resolveCodexNativeExecutionBlock } from "./sandbox-guard-D1Wky__S.js";
-import { a as resolveCodexBindingAppServerConnection, i as requireCodexSupervisionModelSelection, n as readCodexNotificationThreadId, r as readCodexNotificationTurnId } from "./notification-correlation-Bj_Ak_jI.js";
-import { C as CodexNativeToolLifecycleProjector, D as buildCodexNativeHookRelayDisabledConfig, E as buildCodexNativeHookRelayConfig, L as resolveDynamicToolCallTimeoutMs, N as handleDynamicToolCallWithTimeout, S as filterToolsForVisionInputs, U as resolveCodexToolAbortTerminalReason, _ as resolveCodexMessageToolProvider, a as emitDynamicToolStartedDiagnostic, c as resolveCodexProviderWebSearchSupportForClient, i as emitDynamicToolErrorDiagnostic, k as emitCodexNativePreToolUseFailureDiagnostic, n as handleCodexAppServerApprovalRequest, o as emitDynamicToolTerminalDiagnostic, r as handleCodexAppServerElicitationRequest, t as createCodexDynamicToolBridge, w as CODEX_NATIVE_HOOK_RELAY_EVENTS, y as shouldEnableCodexAppServerNativeToolSurface } from "./dynamic-tools-LIt9ojep.js";
+import { M as readRecentCodexRateLimits, W as isJsonObject, a as getLeasedSharedCodexAppServerClient, b as isCodexAppServerApprovalRequest, c as releaseCodexAppServerClientLease, h as withLeasedCodexAppServerClientStartSelectionRetry, k as ensureCodexAppServerClientRuntime, z as resolveCodexAppServerPreparedAuthHandoff } from "./shared-client-DTbvH-XV.js";
+import { A as resolveOpenClawExecPolicyForCodexAppServer, C as canUseCodexModelBackedApprovalsReviewerForModel, O as readCodexPluginConfig, T as resolveCodexModelBackedReviewerPolicyContext, d as sessionBindingIdentity, h as resolveCodexAppServerHomeScope, x as shouldAutoApproveCodexAppServerApprovals } from "./session-binding-BXpo9ymA.js";
+import { A as resolveCodexDynamicToolsLoading, C as resolveReasoningEffort, G as mergeCodexThreadConfigs, S as resolveCodexBindingModelProviderFallback, T as filterCodexDynamicTools, V as buildCodexPluginAppsConfigPatchFromPolicyContext, b as resolveCodexAppServerRequestModelSelection, g as resolveCodexWebSearchPlan, p as buildCodexRuntimeThreadConfig, v as CODEX_NATIVE_PERSONALITY_NONE, w as readCodexSupportedReasoningEfforts, y as resolveCodexAppServerModelProvider } from "./thread-lifecycle-DF53ogiA.js";
+import { S as readCodexTurn, h as assertCodexThreadForkResponse, v as assertCodexTurnStartResponse, y as readCodexDynamicToolCallParams } from "./transcript-mirror-DzsdNCf5.js";
+import { n as formatCodexUsageLimitErrorMessage } from "./rate-limits-CU-gVCCS.js";
+import { t as resolveCodexAppServerForModelProvider } from "./app-server-policy-BSaO2JIT.js";
+import { n as resolveCodexNativeExecutionBlock } from "./sandbox-guard-NuhpXmPB.js";
+import { a as resolveCodexBindingAppServerConnection, i as requireCodexSupervisionModelSelection, n as readCodexNotificationThreadId, r as readCodexNotificationTurnId } from "./notification-correlation-CU6_AnOb.js";
+import { C as filterToolsForVisionInputs, E as CODEX_NATIVE_HOOK_RELAY_EVENTS, F as handleDynamicToolCallWithTimeout, G as resolveCodexToolAbortTerminalReason, O as buildCodexNativeHookRelayConfig, T as CodexNativeToolLifecycleProjector, a as emitDynamicToolStartedDiagnostic, b as shouldEnableCodexAppServerNativeToolSurface, c as resolveCodexProviderWebSearchSupportForClient, i as emitDynamicToolErrorDiagnostic, j as emitCodexNativePreToolUseFailureDiagnostic, k as buildCodexNativeHookRelayDisabledConfig, n as handleCodexAppServerApprovalRequest, o as emitDynamicToolTerminalDiagnostic, r as handleCodexAppServerElicitationRequest, t as createCodexDynamicToolBridge, v as resolveCodexMessageToolProvider, z as resolveDynamicToolCallTimeoutMs } from "./dynamic-tools-D2gYkSBO.js";
 import { buildAgentHookContextChannelFields, embeddedAgentLog, formatErrorMessage, registerNativeHookRelay, resolveAgentDir, resolveAttemptSpawnWorkspaceDir, resolveModelAuthMode, resolveSandboxContext, resolveSessionAgentIds, supportsModelTools } from "openclaw/plugin-sdk/agent-harness-runtime";
 import { randomUUID } from "node:crypto";
 import { loadExecApprovals } from "openclaw/plugin-sdk/exec-approvals-runtime";
@@ -78,7 +78,7 @@ async function runCodexAppServerSideQuestion(params, options) {
 		authProfileId: preparedRuntimeAuth.plan.forwardedAuthProfileId,
 		authProfileStore: preparedRuntimeAuth.authProfileStore,
 		agentDir: params.agentDir,
-		...pluginConfig.appServer?.homeScope ? { homeScope: pluginConfig.appServer.homeScope } : {},
+		homeScope: resolveCodexAppServerHomeScope({ appServer: pluginConfig.appServer }),
 		config: params.cfg,
 		subscriptionProfileRequiredError: "Prepared Codex subscription route requires a scoped native OAuth or token profile.",
 		subscriptionProfileUnusableError: `Prepared Codex auth profile "${preparedRuntimeAuth.plan.forwardedAuthProfileId}" is unusable.`