@openclaw/codex 2026.7.2-beta.5 → 2026.7.33

package/dist/index.js

@@ -1,86 +1,59 @@
-import { registerCodexCliMetadata } from "./cli-metadata.js";
 import { createCodexAppServerAgentHarness } from "./harness.js";
-import { N as resolveCodexAppServerAuthProfileIdForAgent, P as resolveCodexAppServerFallbackApiKeyCacheKey, R as CODEX_INTERACTIVE_THREAD_SOURCE_KINDS, V as isJsonObject, a as getLeasedSharedCodexAppServerClient, c as releaseCodexAppServerClientLease, j as resolveCodexAppServerAuthAccountCacheKey, l as releaseLeasedSharedCodexAppServerClient, m as withLeasedCodexAppServerClientStartSelectionRetry, r as clearSharedCodexAppServerClientIfCurrentAndWait } from "./shared-client-BVKE40c-.js";
-import { D as resolveOpenClawExecPolicyForCodexAppServer, T as readCodexPluginConfig, _ as assertCodexAppServerConnectionSecurity, b as canUseCodexModelBackedApprovalsReviewerForModel, d as codexAppServerStartOptionsKey, f as codexSandboxPolicyForTurn, g as resolveCodexSupervisionAppServerRuntimeOptions, k as CODEX_PLUGINS_MARKETPLACE_NAME, l as sessionBindingIdentity, n as assertCodexBindingMayBeReplaced, o as isCodexAppServerNativeAuthProfile, p as resolveCodexAppServerRuntimeOptions, s as normalizeCodexAppServerBindingModelProvider } from "./session-binding-DlVQ-Pxs.js";
-import { n as CODEX_APP_SERVER_BINDING_NAMESPACE, t as CODEX_APP_SERVER_BINDING_MAX_ENTRIES } from "./session-binding-meta-B7aEMU7g.js";
-import { n as CODEX_APP_SERVER_UNSUBSCRIBE_TIMEOUT_MS, u as unsubscribeCodexThreadBestEffort } from "./attempt-client-cleanup-Ia52yRWc.js";
-import { J as pluginReadParams, _ as CODEX_NATIVE_PERSONALITY_NONE, c as resumeCodexAppServerThread, q as ensureCodexPluginActivation, y as resolveCodexAppServerRequestModelSelection } from "./thread-lifecycle-DRg_FdzC.js";
-import { i as assertCodexThreadStartResponse } from "./protocol-validators-Dm4eXZmt.js";
-import { i as defaultCodexAppInventoryCache, r as buildCodexPluginAppCacheKey } from "./plugin-app-cache-key-DSXX-rXO.js";
-import { t as isIncognitoSessionKey } from "./incognito-session-ET_ufDH-.js";
-import { buildCodexMediaUnderstandingProvider } from "./media-understanding-provider.js";
-import { n as CODEX_REALTIME_OFFER_PATH, t as configureCodexRealtimeBrowserSession } from "./realtime-voice-api-BPcA1uN9.js";
-import { n as describeControlFailure, t as CODEX_CONTROL_METHODS } from "./capabilities-BHRSI6Cn.js";
-import { r as formatCodexDisplayText } from "./command-formatters-ico4ZFnk.js";
-import { t as resolveCodexAppServerForModelProvider } from "./app-server-policy-BmDgseo_.js";
-import { n as resolveCodexNativeExecutionBlock, r as resolveCodexNativeSandboxBlock } from "./sandbox-guard-D1Wky__S.js";
-import { d as CODEX_NATIVE_EXECUTION_AUTH_ERROR, f as canMutateCodexHost, u as trackCodexConversationActiveTurn } from "./conversation-control-DE7d9DOj.js";
-import { a as readCodexConversationBindingDataRecord, i as readCodexConversationBindingData, o as resolveCodexDefaultWorkspaceDir, r as createCodexConversationBindingData } from "./conversation-binding-data-BHRpYbX3.js";
-import { a as resolveCodexBindingAppServerConnection, n as readCodexNotificationThreadId, r as readCodexNotificationTurnId } from "./notification-correlation-Bj_Ak_jI.js";
-import { d as createCodexCliSessionNodeHostCommands, f as createCodexCliSessionNodeInvokePolicies, g as resumeCodexCliSessionOnNode, h as resolveCodexCliSessionForBindingOnNode, i as createCodexSessionCatalogNodeInvokePolicies, m as listCodexCliSessionsOnNode, n as createCodexSessionCatalogControl, o as codexControlRequest, r as createCodexSessionCatalogNodeHostCommands, t as codexSessionCatalogRuntime, u as assertCodexArchiveDescendantsUnowned } from "./session-catalog-CP2oCcEb.js";
-import { r as requestCodexAppServerJson } from "./request-CXpPennK.js";
-import { t as createCodexWebSearchProviderBase } from "./web-search-provider.shared-BrZmlqyR.js";
+import { r as isJsonObject, t as CODEX_INTERACTIVE_THREAD_SOURCE_KINDS } from "./.setup/protocol-2POPqAY4.mjs";
+import { d as resolveCodexAppServerRuntimeOptions, g as resolveOpenClawExecPolicyForCodexAppServer, i as codexSandboxPolicyForTurn, n as canUseCodexModelBackedApprovalsReviewerForModel, t as CODEX_PLUGINS_MARKETPLACE_NAME, u as readCodexPluginConfig } from "./.setup/config-CYEDnLJ2.mjs";
+import { r as assertCodexThreadStartResponse } from "./.setup/protocol-validators-dZQ-UTOa.mjs";
+import { G as pluginReadParams, W as ensureCodexPluginActivation, f as resolveCodexAppServerRequestModelSelection, q as defaultCodexAppInventoryCache, t as CODEX_NATIVE_PERSONALITY_NONE } from "./.setup/thread-lifecycle-u6CZdOOH.mjs";
+import { t as buildCodexProvider } from "./.setup/provider-DGxDs6g8.mjs";
+import { _ as resolveCodexAppServerAuthAccountCacheKey, a as getLeasedSharedCodexAppServerClient, b as resolveCodexAppServerFallbackApiKeyCacheKey, o as releaseLeasedSharedCodexAppServerClient, r as clearSharedCodexAppServerClientIfCurrentAndWait, y as resolveCodexAppServerAuthProfileIdForAgent } from "./.setup/shared-client-B2KmLPRw.mjs";
+import { n as CODEX_APP_SERVER_BINDING_NAMESPACE, t as CODEX_APP_SERVER_BINDING_MAX_ENTRIES } from "./.setup/session-binding-meta-B7aEMU7g.mjs";
+import { a as normalizeCodexAppServerBindingModelProvider, i as isCodexAppServerNativeAuthProfile, s as sessionBindingIdentity } from "./.setup/session-binding-DuihlMJc.mjs";
+import { t as buildCodexMediaUnderstandingProvider } from "./.setup/media-understanding-provider-EbJCyDqe.mjs";
+import { i as describeControlFailure, n as buildCodexPluginAppCacheKey, r as CODEX_CONTROL_METHODS } from "./.setup/plugin-app-cache-key-DR8jV9oS.mjs";
+import { a as formatCodexDisplayText, t as resolveCodexAppServerForModelProvider } from "./.setup/app-server-policy-C_qTMEMy.mjs";
+import { n as resolveCodexNativeExecutionBlock, r as resolveCodexNativeSandboxBlock } from "./.setup/sandbox-guard-DA2TQfZW.mjs";
+import { S as canMutateCodexHost, a as createCodexCliSessionNodeHostCommands, b as trackCodexConversationActiveTurn, c as listCodexCliSessionsOnNode, l as resolveCodexCliSessionForBindingOnNode, o as createCodexCliSessionNodeInvokePolicies, t as codexControlRequest, u as resumeCodexCliSessionOnNode, x as CODEX_NATIVE_EXECUTION_AUTH_ERROR } from "./.setup/command-rpc-BvYsfQ7G.mjs";
+import { a as readCodexConversationBindingDataRecord, i as readCodexConversationBindingData } from "./.setup/conversation-binding-data-CrRxtDBu.mjs";
+import { n as readCodexNotificationThreadId, r as readCodexNotificationTurnId } from "./.setup/notification-correlation-iYs4WieS.mjs";
+import { t as requestCodexAppServerJson } from "./.setup/request-DFR0JyoV.mjs";
+import { t as createCodexWebSearchProviderBase } from "./.setup/web-search-provider.shared-BrZmlqyR.mjs";
 import { mutateConfigFile } from "openclaw/plugin-sdk/config-mutation";
-import { normalizePluginsConfig, resolveEffectiveEnableState, resolveLivePluginConfigObject, resolvePluginConfigObject } from "openclaw/plugin-sdk/plugin-config-runtime";
+import { resolveLivePluginConfigObject, resolvePluginConfigObject } from "openclaw/plugin-sdk/plugin-config-runtime";
 import { definePluginEntry } from "openclaw/plugin-sdk/plugin-entry";
 import fs from "node:fs/promises";
 import path from "node:path";
 import { parseStrictNonNegativeInteger, resolveTimerTimeoutMs } from "openclaw/plugin-sdk/number-runtime";
-import { formatErrorMessage, resolveSandboxContext } from "openclaw/plugin-sdk/agent-harness-runtime";
-import { loadAuthProfileStoreWithoutExternalProfiles, resolveAgentConfig, resolveAgentWorkspaceDir, resolveDefaultAgentDir, resolveDefaultAgentId, resolveSessionAgentIds as resolveSessionAgentIds$1 } from "openclaw/plugin-sdk/agent-runtime";
 import os from "node:os";
-import { applyAuthProfileConfig, buildApiKeyCredential, buildOauthProviderAuthResult, buildOpenAICodexCredentialExtra, readCodexCliCredentialsCached, resolveOpenAICodexAuthIdentity, resolveOpenAICodexImportProfileName, updateAuthProfileStoreWithLock } from "openclaw/plugin-sdk/provider-auth";
+import { loadAuthProfileStoreWithoutExternalProfiles, resolveAgentConfig, resolveAgentWorkspaceDir, resolveDefaultAgentId, resolveSessionAgentIds } from "openclaw/plugin-sdk/agent-runtime";
 import { loadExecApprovals } from "openclaw/plugin-sdk/exec-approvals-runtime";
 import { asBoolean, asOptionalRecord, isRecord, normalizeOptionalString, normalizeSingleOrTrimmedStringList, uniqueStrings } from "openclaw/plugin-sdk/string-coerce-runtime";
-import { getSessionEntry, resolveStorePath } from "openclaw/plugin-sdk/session-store-runtime";
+import { formatErrorMessage, resolveSandboxContext } from "openclaw/plugin-sdk/agent-harness-runtime";
+import { jsonResult, readStringParam } from "openclaw/plugin-sdk/core";
+import { applyAuthProfileConfig, buildApiKeyCredential, buildOauthProviderAuthResult, buildOpenAICodexCredentialExtra, readCodexCliCredentialsCached, resolveOpenAICodexAuthIdentity, resolveOpenAICodexImportProfileName, updateAuthProfileStoreWithLock } from "openclaw/plugin-sdk/provider-auth";
 import { fileURLToPath } from "node:url";
-import { expectDefined } from "openclaw/plugin-sdk/expect-runtime";
-import { canonicalPathFromExistingAncestor, extractErrorCode, isPathInside, pathExists } from "openclaw/plugin-sdk/security-runtime";
+import { pathExists } from "openclaw/plugin-sdk/security-runtime";
+import { getSessionEntry, resolveStorePath } from "openclaw/plugin-sdk/session-store-runtime";
 import { KeyedAsyncQueue } from "openclaw/plugin-sdk/keyed-async-queue";
-import { ModelSelectionLockedError, isModelSelectionLocked } from "openclaw/plugin-sdk/model-session-runtime";
-import { MIGRATION_REASON_TARGET_EXISTS, applyMigrationManualItem, createMigrationItem, createMigrationManualItem, hasMigrationConfigPatchConflict, markMigrationItemConflict, markMigrationItemError, markMigrationItemSkipped, mergeMigrationConfigValue, readMigrationConfigPath, resolveMigrationConfigRuntime, summarizeMigrationItems, writeMigrationConfigPath } from "openclaw/plugin-sdk/migration";
-import { archiveMigrationItem, copyMemoryMigrationFileItem, copyMigrationFileItem, withCachedMigrationConfigRuntime, writeMigrationReport } from "openclaw/plugin-sdk/migration-runtime";
+import { MIGRATION_REASON_TARGET_EXISTS, applyMigrationManualItem, createMigrationItem, createMigrationManualItem, hasMigrationConfigPatchConflict, markMigrationItemConflict, markMigrationItemError, markMigrationItemSkipped, readMigrationConfigPath, summarizeMigrationItems, writeMigrationConfigPath } from "openclaw/plugin-sdk/migration";
+import { archiveMigrationItem, copyMigrationFileItem, withCachedMigrationConfigRuntime, writeMigrationReport } from "openclaw/plugin-sdk/migration-runtime";
 import { sleep } from "openclaw/plugin-sdk/runtime-env";
 import { readJsonFileWithFallback } from "openclaw/plugin-sdk/json-store";
-import { jsonResult, readStringParam } from "openclaw/plugin-sdk/core";
 import { Type } from "typebox";
 import { createLazyRuntimeModule } from "openclaw/plugin-sdk/lazy-runtime";
 //#region extensions/codex/src/app-server/session-binding-store.ts
 /** Defers schema compilation and auth loading until the first binding operation. */
 function createLazyCodexAppServerBindingStore(state) {
 	let resolved;
-	const store = () => resolved ??= import("./session-binding-DlVQ-Pxs.js").then((n) => n.u).then(({ createCodexAppServerBindingStore }) => createCodexAppServerBindingStore(state));
+	const store = () => resolved ??= import("./.setup/session-binding-DuihlMJc.mjs").then((n) => n.c).then(({ createCodexAppServerBindingStore }) => createCodexAppServerBindingStore(state));
 	return {
 		read: async (identity) => (await store()).read(identity),
-		hasOtherThreadOwner: async (threadId, currentIdentity) => (await store()).hasOtherThreadOwner(threadId, currentIdentity),
 		mutate: async (identity, mutation) => (await store()).mutate(identity, mutation),
 		prepareSessionGenerationReclaim: async (identity) => (await store()).prepareSessionGenerationReclaim(identity),
 		adoptSessionGeneration: async (identity, previousSessionId) => (await store()).adoptSessionGeneration(identity, previousSessionId),
-		resetSessionGeneration: async (identity) => (await store()).resetSessionGeneration(identity),
 		retireSessionGeneration: async (identity) => (await store()).retireSessionGeneration(identity),
-		withThreadArchiveFence: async (run) => (await store()).withThreadArchiveFence(run),
 		withLease: async (identity, run) => (await store()).withLease(identity, run)
 	};
 }
 //#endregion
-//#region extensions/codex/src/command-dispatch.ts
-/** Dispatches a `/codex` command to the lazily loaded handler. */
-async function handleCodexCommand(ctx, options) {
-	const { loadSubcommandHandler, resolvePluginConfig, ...subcommandOptions } = options;
-	try {
-		return await (loadSubcommandHandler ? await loadSubcommandHandler() : await loadDefaultCodexSubcommandHandler())(ctx, {
-			...subcommandOptions,
-			pluginConfig: resolvePluginConfig?.() ?? subcommandOptions.pluginConfig
-		});
-	} catch (error) {
-		return { text: `Codex command failed: ${formatCodexDisplayText(describeControlFailure(error))}` };
-	}
-}
-async function loadDefaultCodexSubcommandHandler() {
-	const { handleCodexSubcommand } = await import("./command-handlers-CRmnwI2N.js");
-	return handleCodexSubcommand;
-}
-//#endregion
 //#region extensions/codex/src/commands.ts
 /** Creates the reserved `/codex` command definition exposed by the plugin. */
 function createCodexCommand(options) {
@@ -100,6 +73,22 @@ function createCodexCommand(options) {
 		handler: (ctx) => handleCodexCommand(ctx, options)
 	};
 }
+/** Dispatches a `/codex` command to the subcommand handler and formats failures for chat. */
+async function handleCodexCommand(ctx, options) {
+	const { loadSubcommandHandler, resolvePluginConfig, ...subcommandOptions } = options;
+	try {
+		return await (loadSubcommandHandler ? await loadSubcommandHandler() : await loadDefaultCodexSubcommandHandler())(ctx, {
+			...subcommandOptions,
+			pluginConfig: resolvePluginConfig?.() ?? subcommandOptions.pluginConfig
+		});
+	} catch (error) {
+		return { text: `Codex command failed: ${formatCodexDisplayText(describeControlFailure(error))}` };
+	}
+}
+async function loadDefaultCodexSubcommandHandler() {
+	const { handleCodexSubcommand } = await import("./.setup/command-handlers-DSRFfor4.mjs");
+	return handleCodexSubcommand;
+}
 //#endregion
 //#region extensions/codex/src/conversation-turn-collector.ts
 const MAX_PENDING_NOTIFICATIONS_PER_TURN = 100;
@@ -295,7 +284,7 @@ function readLocalMediaPath(value) {
 }
 //#endregion
 //#region extensions/codex/src/conversation-binding.ts
-const DEFAULT_BOUND_TURN_TIMEOUT_MS = 20 * 6e4;
+const DEFAULT_BOUND_TURN_TIMEOUT_MS = 12e5;
 const DEFAULT_AGENT_ID = "main";
 const VALID_AGENT_ID_PATTERN = /^[a-z0-9][a-z0-9_-]{0,63}$/i;
 const INVALID_AGENT_ID_CHARS_PATTERN = /[^a-z0-9_-]+/g;
@@ -333,72 +322,6 @@ function getGlobalState() {
 	globalState[CODEX_CONVERSATION_GLOBAL_STATE] ??= { queue: new KeyedAsyncQueue() };
 	return globalState[CODEX_CONVERSATION_GLOBAL_STATE];
 }
-async function startCodexConversationThread(params) {
-	const workspaceDir = params.workspaceDir?.trim() || resolveCodexDefaultWorkspaceDir(params.pluginConfig);
-	const agentDir = params.agentDir?.trim();
-	const agentLookup = buildAgentLookup({
-		agentDir,
-		config: params.config
-	});
-	const identity = sessionBindingIdentity({
-		agentId: params.agentId,
-		sessionId: params.sessionFile,
-		sessionKey: params.sessionKey,
-		config: params.config
-	});
-	const existingBinding = await params.bindingStore.read(identity);
-	assertCodexBindingMayBeReplaced(existingBinding, "starting a conversation-bound Codex thread");
-	const authProfileId = resolveCodexAppServerAuthProfileIdForAgent({
-		authProfileId: params.authProfileId ?? existingBinding?.authProfileId,
-		...agentLookup
-	});
-	if (params.threadId?.trim()) await attachExistingThread({
-		pluginConfig: params.pluginConfig,
-		bindingStore: params.bindingStore,
-		identity,
-		threadId: params.threadId.trim(),
-		workspaceDir,
-		...agentDir ? { agentDir } : {},
-		model: params.model,
-		modelProvider: params.modelProvider,
-		authProfileId,
-		approvalPolicy: params.approvalPolicy,
-		sandbox: params.sandbox,
-		serviceTier: params.serviceTier,
-		config: params.config,
-		sessionKey: params.sessionKey,
-		agentId: params.agentId
-	});
-	else await createThread({
-		pluginConfig: params.pluginConfig,
-		bindingStore: params.bindingStore,
-		identity,
-		workspaceDir,
-		...agentDir ? { agentDir } : {},
-		model: params.model,
-		modelProvider: params.modelProvider,
-		authProfileId,
-		approvalPolicy: params.approvalPolicy,
-		sandbox: params.sandbox,
-		serviceTier: params.serviceTier,
-		config: params.config,
-		sessionKey: params.sessionKey,
-		agentId: params.agentId
-	});
-	const storedBinding = await params.bindingStore.read(identity);
-	if (!storedBinding) throw new Error("Codex session binding disappeared while starting its conversation thread.");
-	return createCodexConversationBindingData({
-		source: {
-			agentId: identity.agentId,
-			sessionId: identity.sessionId,
-			threadId: storedBinding.threadId,
-			...identity.sessionKey ? { sessionKey: identity.sessionKey } : {}
-		},
-		workspaceDir,
-		...agentDir ? { agentDir } : {},
-		agentId: params.agentId
-	});
-}
 async function handleCodexConversationInboundClaim(event, ctx, options) {
 	const data = readCodexConversationBindingData(ctx.pluginBinding);
 	if (!data) return;
@@ -476,7 +399,6 @@ async function handleCodexConversationBindingResolved(event, options) {
 	if (!data || data.kind !== "codex-app-server-session") return;
 	const identity = conversationBindingIdentity(data);
 	const binding = await options.bindingStore.read(identity);
-	assertCodexBindingMayBeReplaced(binding, "clearing a denied conversation binding");
 	if (!data.start?.id || binding?.conversationStartId === data.start.id) await options.bindingStore.mutate(identity, { kind: "clear" });
 }
 async function resolveThreadBindingRuntime(params) {
@@ -530,22 +452,19 @@ async function resolveThreadBindingRuntime(params) {
 			agentDir: params.agentDir
 		})
 	});
-	const clientOptions = {
+	const client = await getLeasedSharedCodexAppServerClient({
 		startOptions: runtime.start,
 		timeoutMs: runtime.requestTimeoutMs,
 		authProfileId: params.authProfileId,
 		...agentLookup
-	};
-	const client = await getLeasedSharedCodexAppServerClient(clientOptions);
+	});
 	return {
 		execPolicy,
 		runtime: modelScopedRuntime,
 		agentLookup,
 		model: modelSelection?.model,
 		modelProvider: modelSelection?.modelProvider ?? modelProvider,
-		client,
-		clientLease: { client },
-		clientOptions
+		client
 	};
 }
 function buildThreadRequestRuntimeOptions(params, resolved) {
@@ -564,32 +483,22 @@ function codexConversationSandboxOrPermissions(runtime, sandbox) {
 	return { sandbox };
 }
 async function requestNewConversationBindingThread(params, resolved) {
-	return await withLeasedCodexAppServerClientStartSelectionRetry({
-		lease: resolved.clientLease,
-		options: resolved.clientOptions,
-		run: async (client, requestOptions) => await client.request("thread/start", {
-			cwd: params.workspaceDir,
-			...resolved.model ? { model: resolved.model } : {},
-			...resolved.modelProvider ? { modelProvider: resolved.modelProvider } : {},
-			personality: CODEX_NATIVE_PERSONALITY_NONE,
-			...buildThreadRequestRuntimeOptions(params, resolved),
-			developerInstructions: CODEX_CONVERSATION_THREAD_DEVELOPER_INSTRUCTIONS,
-			experimentalRawEvents: true,
-			...isIncognitoSessionKey(params.sessionKey) ? { ephemeral: true } : {}
-		}, requestOptions),
-		onClientChange: (client) => {
-			resolved.client = client;
-		}
-	});
+	return await resolved.client.request("thread/start", {
+		cwd: params.workspaceDir,
+		...resolved.model ? { model: resolved.model } : {},
+		...resolved.modelProvider ? { modelProvider: resolved.modelProvider } : {},
+		personality: CODEX_NATIVE_PERSONALITY_NONE,
+		...buildThreadRequestRuntimeOptions(params, resolved),
+		developerInstructions: CODEX_CONVERSATION_THREAD_DEVELOPER_INSTRUCTIONS,
+		experimentalRawEvents: true
+	}, { timeoutMs: resolved.runtime.requestTimeoutMs });
 }
 async function writeThreadBindingFromResponse(params, resolved, response) {
-	assertCodexBindingMayBeReplaced(await params.bindingStore.read(params.identity), "storing a conversation-bound Codex thread");
 	const runtimeApprovalPolicy = typeof resolved.runtime.approvalPolicy === "string" ? resolved.runtime.approvalPolicy : void 0;
 	if (!await params.bindingStore.mutate(params.identity, {
 		kind: "set",
 		binding: {
 			threadId: response.thread.id,
-			clientId: resolved.client.getInstanceId(),
 			cwd: response.thread.cwd ?? params.workspaceDir,
 			authProfileId: params.authProfileId,
 			model: response.model ?? resolved.model ?? params.model,
@@ -607,34 +516,25 @@ async function writeThreadBindingFromResponse(params, resolved, response) {
 	})) throw new Error("Codex conversation binding changed while storing its thread.");
 }
 async function attachExistingThread(params) {
-	assertCodexBindingMayBeReplaced(await params.bindingStore.read(params.identity), "attaching a conversation-bound Codex thread");
 	const resolved = await resolveThreadBindingRuntime(params);
 	try {
-		await writeThreadBindingFromResponse(params, resolved, resolved.runtime.networkProxy ? await requestNewConversationBindingThread(params, resolved) : await withLeasedCodexAppServerClientStartSelectionRetry({
-			lease: resolved.clientLease,
-			options: resolved.clientOptions,
-			run: async (client, requestOptions) => await client.request(CODEX_CONTROL_METHODS.resumeThread, {
-				threadId: params.threadId,
-				...resolved.model ? { model: resolved.model } : {},
-				...resolved.modelProvider ? { modelProvider: resolved.modelProvider } : {},
-				personality: CODEX_NATIVE_PERSONALITY_NONE,
-				...buildThreadRequestRuntimeOptions(params, resolved)
-			}, requestOptions),
-			onClientChange: (client) => {
-				resolved.client = client;
-			}
-		}));
+		await writeThreadBindingFromResponse(params, resolved, resolved.runtime.networkProxy ? await requestNewConversationBindingThread(params, resolved) : await resolved.client.request(CODEX_CONTROL_METHODS.resumeThread, {
+			threadId: params.threadId,
+			...resolved.model ? { model: resolved.model } : {},
+			...resolved.modelProvider ? { modelProvider: resolved.modelProvider } : {},
+			personality: CODEX_NATIVE_PERSONALITY_NONE,
+			...buildThreadRequestRuntimeOptions(params, resolved)
+		}, { timeoutMs: resolved.runtime.requestTimeoutMs }));
 	} finally {
-		releaseCodexAppServerClientLease(resolved.clientLease);
+		releaseLeasedSharedCodexAppServerClient(resolved.client);
 	}
 }
 async function createThread(params) {
-	assertCodexBindingMayBeReplaced(await params.bindingStore.read(params.identity), "creating a conversation-bound Codex thread");
 	const resolved = await resolveThreadBindingRuntime(params);
 	try {
 		await writeThreadBindingFromResponse(params, resolved, await requestNewConversationBindingThread(params, resolved));
 	} finally {
-		releaseCodexAppServerClientLease(resolved.clientLease);
+		releaseLeasedSharedCodexAppServerClient(resolved.client);
 	}
 }
 async function runBoundTurn(params) {
@@ -645,7 +545,6 @@ async function runBoundTurn(params) {
 	const identity = conversationBindingIdentity(params.data);
 	const binding = await params.bindingStore.read(identity);
 	if (!binding?.threadId) throw new Error("bound Codex conversation has no thread binding");
-	assertCodexBindingMayBeReplaced(binding, "running a conversation-bound Codex thread");
 	let threadId = binding.threadId;
 	const workspaceDir = binding.cwd || params.data.workspaceDir;
 	const reviewerModelProvider = resolveModelBackedReviewerPolicyProvider({
@@ -698,44 +597,33 @@ async function runBoundTurn(params) {
 		authProfileId: binding.authProfileId,
 		...agentLookup
 	}) : void 0;
-	const clientOptions = {
+	const client = await getLeasedSharedCodexAppServerClient({
 		startOptions: runtime.start,
 		timeoutMs: runtime.requestTimeoutMs,
 		authProfileId: binding.authProfileId,
 		...agentLookup
-	};
-	let client = await getLeasedSharedCodexAppServerClient(clientOptions);
-	const clientLease = { client };
+	});
 	let notificationCleanup = () => void 0;
 	let requestCleanup = () => void 0;
 	try {
 		if (networkProxyBindingChanged) {
-			const response = assertCodexThreadStartResponse(await withLeasedCodexAppServerClientStartSelectionRetry({
-				lease: clientLease,
-				options: clientOptions,
-				run: async (requestClient, requestOptions) => await requestClient.request("thread/start", {
-					cwd: workspaceDir,
-					...modelSelection?.model ? { model: modelSelection.model } : {},
-					...modelSelection?.modelProvider ? { modelProvider: modelSelection.modelProvider } : {},
-					personality: CODEX_NATIVE_PERSONALITY_NONE,
-					approvalPolicy,
-					approvalsReviewer: modelScopedRuntime.approvalsReviewer,
-					...modelScopedRuntime.networkProxy ? { config: modelScopedRuntime.networkProxy.configPatch } : { sandbox },
-					...serviceTier ? { serviceTier } : {},
-					developerInstructions: CODEX_CONVERSATION_THREAD_DEVELOPER_INSTRUCTIONS,
-					experimentalRawEvents: true,
-					...isIncognitoSessionKey(params.sessionKey) ? { ephemeral: true } : {}
-				}, requestOptions),
-				onClientChange: (nextClient) => {
-					client = nextClient;
-				}
-			}));
+			const response = assertCodexThreadStartResponse(await client.request("thread/start", {
+				cwd: workspaceDir,
+				...modelSelection?.model ? { model: modelSelection.model } : {},
+				...modelSelection?.modelProvider ? { modelProvider: modelSelection.modelProvider } : {},
+				personality: CODEX_NATIVE_PERSONALITY_NONE,
+				approvalPolicy,
+				approvalsReviewer: modelScopedRuntime.approvalsReviewer,
+				...modelScopedRuntime.networkProxy ? { config: modelScopedRuntime.networkProxy.configPatch } : { sandbox },
+				...serviceTier ? { serviceTier } : {},
+				developerInstructions: CODEX_CONVERSATION_THREAD_DEVELOPER_INSTRUCTIONS,
+				experimentalRawEvents: true
+			}, { timeoutMs: runtime.requestTimeoutMs }));
 			threadId = response.thread.id;
 			if (!await params.bindingStore.mutate(identity, {
 				kind: "set",
 				binding: {
 					threadId,
-					clientId: client.getInstanceId(),
 					cwd: response.thread.cwd ?? workspaceDir,
 					authProfileId: binding.authProfileId,
 					model: response.model ?? modelSelection?.model ?? binding.model,
@@ -755,46 +643,6 @@ async function runBoundTurn(params) {
 				}
 			})) throw new Error("Codex conversation binding changed while rotating its thread.");
 			useStickyNetworkProfile = modelScopedRuntime.networkProxy !== void 0;
-		} else if (binding.clientId !== client.getInstanceId()) {
-			const response = await withLeasedCodexAppServerClientStartSelectionRetry({
-				lease: clientLease,
-				options: clientOptions,
-				run: async (requestClient, requestOptions) => await resumeCodexAppServerThread({
-					client: requestClient,
-					abandonClient: async () => {
-						await requestClient.closeAndWait();
-					},
-					request: {
-						threadId,
-						...modelSelection?.model ? { model: modelSelection.model } : {},
-						...modelSelection?.modelProvider ? { modelProvider: modelSelection.modelProvider } : {},
-						personality: CODEX_NATIVE_PERSONALITY_NONE,
-						approvalPolicy,
-						approvalsReviewer: modelScopedRuntime.approvalsReviewer,
-						...codexConversationSandboxOrPermissions(modelScopedRuntime, sandbox),
-						...serviceTier ? { serviceTier } : {}
-					},
-					...requestOptions
-				}),
-				onClientChange: (nextClient) => {
-					client = nextClient;
-				}
-			});
-			threadId = response.thread.id;
-			if (!await params.bindingStore.mutate(identity, {
-				kind: "patch",
-				threadId: binding.threadId,
-				patch: {
-					clientId: client.getInstanceId(),
-					cwd: response.thread.cwd ?? binding.cwd,
-					model: response.model ?? modelSelection?.model ?? binding.model,
-					modelProvider: normalizeCodexAppServerBindingModelProvider({
-						authProfileId: binding.authProfileId,
-						modelProvider: response.modelProvider ?? modelSelection?.modelProvider ?? binding.modelProvider,
-						...agentLookup
-					})
-				}
-			})) throw new Error("Codex conversation binding changed while resuming on a new client.");
 		}
 		const collector = createCodexConversationTurnCollector(threadId);
 		notificationCleanup = client.addNotificationHandler((notification) => collector.handleNotification(notification));
@@ -835,29 +683,15 @@ async function runBoundTurn(params) {
 		}, { timeoutMs: runtime.requestTimeoutMs })).turn.id;
 		const activeCleanup = trackCodexConversationActiveTurn({
 			identity,
-			client,
 			threadId,
 			turnId
 		});
 		collector.setTurnId(turnId);
 		return { reply: { text: (await collector.wait({ timeoutMs: params.timeoutMs ?? DEFAULT_BOUND_TURN_TIMEOUT_MS }).finally(activeCleanup)).replyText.trim() || "Codex completed without a text reply." } };
-	} catch (error) {
-		if (isIncognitoSessionKey(params.sessionKey)) {
-			const bindingReleased = await params.bindingStore.mutate(identity, {
-				kind: "clear",
-				threadId
-			});
-			const timedOut = error instanceof Error && error.message === "codex app-server bound turn timed out";
-			if (bindingReleased && !timedOut) await unsubscribeCodexThreadBestEffort(client, {
-				threadId,
-				timeoutMs: CODEX_APP_SERVER_UNSUBSCRIBE_TIMEOUT_MS
-			});
-		}
-		throw error;
 	} finally {
 		notificationCleanup();
 		requestCleanup();
-		releaseCodexAppServerClientLease(clientLease);
+		releaseLeasedSharedCodexAppServerClient(client);
 	}
 }
 function assertNativeConversationApprovalPolicySupported(params) {
@@ -886,8 +720,6 @@ async function prepareConversationBinding(params, options = {}) {
 			config: params.config
 		}) : void 0;
 		const sourceBinding = sourceIdentity ? await params.bindingStore.read(sourceIdentity) : void 0;
-		assertCodexBindingMayBeReplaced(current, "initializing a conversation-bound Codex thread");
-		assertCodexBindingMayBeReplaced(sourceBinding, "transferring a session into a conversation-bound Codex thread");
 		const inherited = current ?? sourceBinding;
 		const execPolicy = resolveConversationExecPolicy({
 			config: params.config,
@@ -940,7 +772,7 @@ async function prepareConversationBinding(params, options = {}) {
 	});
 }
 function resolveConversationExecPolicy(params) {
-	const agentId = params.agentId ?? (params.config ? resolveSessionAgentIds$1({
+	const agentId = params.agentId ?? (params.config ? resolveSessionAgentIds({
 		sessionKey: params.sessionKey,
 		config: params.config
 	}).sessionAgentId : void 0);
@@ -963,8 +795,9 @@ function readSessionExecOverrides(params) {
 		agentId: params.agentId,
 		sessionKey
 	})) return;
+	const storePath = resolveStorePath(params.config.session?.store, { agentId: params.agentId });
 	const entry = getSessionEntry({
-		storePath: resolveStorePath(params.config.session?.store, { agentId: params.agentId }),
+		storePath,
 		sessionKey,
 		readConsistency: "latest"
 	});
@@ -1050,44 +883,6 @@ function conversationBindingIdentity(data) {
 		bindingId: data.bindingId
 	};
 }
-const codexConversationBindingRuntime = {
-	startThread: startCodexConversationThread,
-	handleInboundClaim: handleCodexConversationInboundClaim,
-	handleBindingResolved: handleCodexConversationBindingResolved
-};
-//#endregion
-//#region extensions/codex/src/migration/apply-report.ts
-function codexPluginActivationReportState(result) {
-	switch (result.reason) {
-		case "already_active":
-		case "installed": return {
-			installed: true,
-			enabled: true
-		};
-		case "auth_required": return {
-			installed: true,
-			enabled: false
-		};
-		case "disabled":
-		case "marketplace_missing":
-		case "plugin_missing": return {
-			installed: false,
-			enabled: false
-		};
-		case "refresh_failed": return {
-			installed: true,
-			enabled: false
-		};
-	}
-	return result.reason;
-}
-function sanitizeAppsNeedingAuth(apps) {
-	return apps.map((app) => ({
-		id: app.id,
-		name: app.name,
-		needsAuth: app.needsAuth
-	}));
-}
 //#endregion
 //#region extensions/codex/src/migration/helpers.ts
 async function exists(filePath) {
@@ -1141,6 +936,11 @@ async function readModelRefs(source) {
 	refs.add(OPENAI_CODEX_DEFAULT_MODEL);
 	return [...refs].toSorted();
 }
+function readProviderAuthModelConfigs(result) {
+	const models = result.configPatch?.agents?.defaults?.models;
+	if (isRecord(models)) return { ...models };
+	return { [normalizeOptionalString(result.defaultModel) ?? OPENAI_CODEX_DEFAULT_MODEL]: {} };
+}
 async function buildCodexOAuthCredential(source) {
 	const credential = readCodexCliCredentialsCached({
 		codexHome: source.codexHome,
@@ -1175,11 +975,13 @@ async function buildCodexOAuthCredential(source) {
 		kind: "oauth",
 		provider: OPENAI_PROVIDER_ID,
 		profileId: profile.profileId,
-		result
+		result,
+		modelConfigs: readProviderAuthModelConfigs(result)
 	} : null;
 }
 async function buildCodexApiKeyCredential(source) {
-	const key = normalizeOptionalString((await readJsonObject(source.authPath)).OPENAI_API_KEY);
+	const raw = await readJsonObject(source.authPath);
+	const key = normalizeOptionalString(raw.OPENAI_API_KEY);
 	if (!key) return null;
 	return {
 		kind: "api_key",
@@ -1233,7 +1035,7 @@ function hasAuthProfileConfigConflict(config, profile, overwrite) {
 function hasCurrentAuthProfileConfigConflict(ctx, profile) {
 	let config = ctx.config;
 	try {
-		config = resolveMigrationConfigRuntime(ctx)?.current?.() ?? config;
+		config = ctx.runtime?.config?.current?.() ?? config;
 	} catch {}
 	return hasAuthProfileConfigConflict(config, profile, Boolean(ctx.overwrite));
 }
@@ -1254,8 +1056,30 @@ function applyDefaultModelIfMissing(cfg) {
 		}
 	};
 }
+function mergeModelConfigEntry(existing, patch) {
+	if (existing && isRecord(existing) && isRecord(patch)) return {
+		...existing,
+		...patch
+	};
+	return existing ?? patch;
+}
+function applyOAuthModelConfigsToConfig(cfg, credential) {
+	const existingModels = cfg.agents?.defaults?.models ?? {};
+	const models = credential.result.replaceDefaultModels ? { ...credential.modelConfigs } : { ...existingModels };
+	if (!credential.result.replaceDefaultModels) for (const [modelRef, modelConfig] of Object.entries(credential.modelConfigs)) models[modelRef] = mergeModelConfigEntry(models[modelRef], modelConfig);
+	return {
+		...cfg,
+		agents: {
+			...cfg.agents,
+			defaults: {
+				...cfg.agents?.defaults,
+				models
+			}
+		}
+	};
+}
 function applyOAuthConfigToConfig(cfg, credential, profileId) {
-	let next = mergeMigrationConfigValue(cfg, credential.result.configPatch);
+	let next = applyOAuthModelConfigsToConfig(cfg, credential);
 	const profile = credential.result.profiles[0];
 	if (profile) next = applyAuthProfileConfig(next, {
 		profileId,
@@ -1279,25 +1103,30 @@ function applyApiKeyConfigToConfig(cfg, credential, profileId) {
 function shouldReturnAuthConfigPatch(ctx) {
 	return ctx.providerOptions?.configPatchMode === CODEX_CONFIG_PATCH_MODE_RETURN$1;
 }
-function authProfileConfigForCredential(credential, profileId) {
-	if (credential.kind === "api_key") return {
-		profileId,
-		provider: credential.provider,
-		mode: "api_key",
-		displayName: CODEX_IMPORT_DISPLAY_NAME
-	};
+function oauthAuthProfileConfig(credential, profileId) {
 	const profile = credential.result.profiles[0];
 	if (!profile || profile.credential.type !== "oauth") return null;
 	return {
 		profileId,
 		provider: profile.credential.provider,
 		mode: "oauth",
-		...profile.credential.email ? { email: profile.credential.email } : {},
-		...profile.credential.displayName ? { displayName: profile.credential.displayName } : {}
+		..."email" in profile.credential && profile.credential.email ? { email: profile.credential.email } : {},
+		..."displayName" in profile.credential && profile.credential.displayName ? { displayName: profile.credential.displayName } : {}
+	};
+}
+function apiKeyAuthProfileConfig(credential, profileId) {
+	return {
+		profileId,
+		provider: credential.provider,
+		mode: "api_key",
+		displayName: CODEX_IMPORT_DISPLAY_NAME
 	};
 }
+function authProfileConfigForCredential(credential, profileId) {
+	return credential.kind === "oauth" ? oauthAuthProfileConfig(credential, profileId) : apiKeyAuthProfileConfig(credential, profileId);
+}
 async function applyCodexAuthProfileConfig(ctx, profile, applyConfig) {
-	const configApi = resolveMigrationConfigRuntime(ctx);
+	const configApi = ctx.runtime?.config;
 	if (!configApi?.current || !configApi.mutateConfigFile) return "unavailable";
 	try {
 		await configApi.mutateConfigFile({
@@ -1314,13 +1143,13 @@ async function applyCodexAuthProfileConfig(ctx, profile, applyConfig) {
 		return error instanceof CodexAuthConfigConflict ? "conflict" : "unavailable";
 	}
 }
-async function applyCodexAuthConfig(ctx, credential, profileId) {
-	const profile = authProfileConfigForCredential(credential, profileId);
+async function applyOAuthConfig(ctx, credential, profileId) {
+	const profile = oauthAuthProfileConfig(credential, profileId);
 	if (!profile) return "unavailable";
-	return applyCodexAuthProfileConfig(ctx, profile, (config) => applyCredentialConfig(config, credential, profileId));
+	return applyCodexAuthProfileConfig(ctx, profile, (config) => applyOAuthConfigToConfig(config, credential, profileId));
 }
-function applyCredentialConfig(config, credential, profileId) {
-	return credential.kind === "oauth" ? applyOAuthConfigToConfig(config, credential, profileId) : applyApiKeyConfigToConfig(config, credential, profileId);
+async function applyApiKeyConfig(ctx, credential, profileId) {
+	return applyCodexAuthProfileConfig(ctx, apiKeyAuthProfileConfig(credential, profileId), (config) => applyApiKeyConfigToConfig(config, credential, profileId));
 }
 async function buildCodexAuthItems(params) {
 	const credentials = await readCodexAuthCredentials(params.source);
@@ -1353,27 +1182,26 @@ async function buildCodexAuthItems(params) {
 		});
 	});
 }
-async function applyCodexAuthItems(params) {
+async function applyCodexAuthItem(params) {
 	const { ctx, item, source, targets } = params;
-	if (item.status !== "planned") return [item];
+	if (item.status !== "planned") return item;
 	const profileId = typeof item.details?.profileId === "string" ? item.details.profileId : "";
 	const provider = typeof item.details?.provider === "string" ? item.details.provider : "";
 	const sourceProfileId = typeof item.details?.sourceProfileId === "string" ? item.details.sourceProfileId : void 0;
-	if (!profileId || !provider) return [markMigrationItemError(item, CODEX_REASON_MISSING_AUTH_METADATA)];
+	if (!profileId || !provider) return markMigrationItemError(item, CODEX_REASON_MISSING_AUTH_METADATA);
 	const credential = (await readCodexAuthCredentials(source)).find((candidate) => candidate.provider === provider);
-	if (!credential) return [markMigrationItemSkipped(item, CODEX_REASON_AUTH_NO_LONGER_PRESENT)];
-	if (credential.kind === "oauth" && sourceProfileId && credential.profileId !== sourceProfileId) return [markMigrationItemSkipped(item, CODEX_REASON_AUTH_NO_LONGER_PRESENT)];
+	if (!credential) return markMigrationItemSkipped(item, CODEX_REASON_AUTH_NO_LONGER_PRESENT);
+	if (credential.kind === "oauth" && sourceProfileId && credential.profileId !== sourceProfileId) return markMigrationItemSkipped(item, CODEX_REASON_AUTH_NO_LONGER_PRESENT);
 	const oauthProfile = credential.kind === "oauth" ? credential.result.profiles[0] : void 0;
 	const oauthCredential = oauthProfile?.credential.type === "oauth" ? oauthProfile.credential : void 0;
-	if (credential.kind === "oauth" && !oauthCredential) return [markMigrationItemError(item, CODEX_REASON_MISSING_AUTH_METADATA)];
+	if (credential.kind === "oauth" && !oauthCredential) return markMigrationItemError(item, CODEX_REASON_MISSING_AUTH_METADATA);
 	const configProfile = authProfileConfigForCredential(credential, profileId);
-	if (!configProfile) return [markMigrationItemError(item, CODEX_REASON_MISSING_AUTH_METADATA)];
-	if (hasCurrentAuthProfileConfigConflict(ctx, configProfile)) return [markMigrationItemConflict(item, CODEX_REASON_AUTH_PROFILE_EXISTS)];
+	if (!configProfile) return markMigrationItemError(item, CODEX_REASON_MISSING_AUTH_METADATA);
+	if (hasCurrentAuthProfileConfigConflict(ctx, configProfile)) return markMigrationItemConflict(item, CODEX_REASON_AUTH_PROFILE_EXISTS);
 	let conflicted = false;
 	let wrote = false;
 	const store = await updateAuthProfileStoreWithLock({
 		agentDir: targets.agentDir,
-		stateDir: ctx.stateDir,
 		updater: (freshStore) => {
 			const existing = freshStore.profiles[profileId];
 			if (!ctx.overwrite && existing) {
@@ -1392,11 +1220,11 @@ async function applyCodexAuthItems(params) {
 			return true;
 		}
 	});
-	if (conflicted) return [markMigrationItemConflict(item, CODEX_REASON_AUTH_PROFILE_EXISTS)];
-	if (!store?.profiles[profileId]) return [markMigrationItemError(item, CODEX_REASON_AUTH_PROFILE_WRITE_FAILED)];
-	const configResult = shouldReturnAuthConfigPatch(ctx) ? "unavailable" : await applyCodexAuthConfig(ctx, credential, profileId);
-	if (configResult === "conflict") return [markMigrationItemConflict(item, CODEX_REASON_AUTH_PROFILE_EXISTS)];
-	const migratedItem = {
+	if (conflicted) return markMigrationItemConflict(item, CODEX_REASON_AUTH_PROFILE_EXISTS);
+	if (!store?.profiles[profileId]) return markMigrationItemError(item, CODEX_REASON_AUTH_PROFILE_WRITE_FAILED);
+	const configResult = shouldReturnAuthConfigPatch(ctx) ? "unavailable" : credential.kind === "oauth" ? await applyOAuthConfig(ctx, credential, profileId) : await applyApiKeyConfig(ctx, credential, profileId);
+	if (configResult === "conflict") return markMigrationItemConflict(item, CODEX_REASON_AUTH_PROFILE_EXISTS);
+	return {
 		...item,
 		status: "migrated",
 		details: {
@@ -1406,10 +1234,18 @@ async function applyCodexAuthItems(params) {
 			...shouldReturnAuthConfigPatch(ctx) ? { configPatchReturned: true } : {}
 		}
 	};
-	return [migratedItem, ...shouldReturnAuthConfigPatch(ctx) ? buildCodexAuthConfigPatchItems(ctx, migratedItem, credential, profileId) : []];
 }
-function buildCodexAuthConfigPatchItems(ctx, item, credential, profileId) {
-	const next = applyCredentialConfig(ctx.config, credential, profileId);
+async function buildCodexAuthConfigPatchItems(params) {
+	const { ctx, item, source } = params;
+	if (item.status !== "migrated" || !shouldReturnAuthConfigPatch(ctx)) return [];
+	const profileId = typeof item.details?.profileId === "string" ? item.details.profileId : "";
+	const provider = typeof item.details?.provider === "string" ? item.details.provider : "";
+	const sourceProfileId = typeof item.details?.sourceProfileId === "string" ? item.details.sourceProfileId : void 0;
+	if (!profileId || !provider) return [];
+	const credential = (await readCodexAuthCredentials(source)).find((candidate) => candidate.provider === provider);
+	if (!credential) return [];
+	if (credential.kind === "oauth" && sourceProfileId && credential.profileId !== sourceProfileId) return [];
+	const next = credential.kind === "oauth" ? applyOAuthConfigToConfig(ctx.config, credential, profileId) : applyApiKeyConfigToConfig(ctx.config, credential, profileId);
 	const items = [];
 	if (next.auth) items.push(createMigrationItem({
 		id: `${item.id}:config:auth`,
@@ -1438,10 +1274,16 @@ function buildCodexAuthConfigPatchItems(ctx, item, credential, profileId) {
 	return items;
 }
 //#endregion
-//#region extensions/codex/src/migration/source-files.ts
+//#region extensions/codex/src/migration/source.ts
 const SKILL_FILENAME = "SKILL.md";
 const MAX_SCAN_DEPTH = 6;
 const MAX_DISCOVERED_DIRS = 2e3;
+function defaultCodexHome() {
+	return resolveHomePath(process.env.CODEX_HOME?.trim() || "~/.codex");
+}
+function personalAgentsSkillsDir() {
+	return path.join(resolveUserHomeDir(), ".agents", "skills");
+}
 async function safeReadDir(dir) {
 	return await fs.readdir(dir, { withFileTypes: true }).catch(() => []);
 }
@@ -1460,7 +1302,10 @@ async function discoverSkillDirs(params) {
 			});
 			return;
 		}
-		for (const entry of await safeReadDir(dir)) if (entry.isDirectory()) await visit(path.join(dir, entry.name), depth + 1);
+		for (const entry of await safeReadDir(dir)) {
+			if (!entry.isDirectory()) continue;
+			await visit(path.join(dir, entry.name), depth + 1);
+		}
 	}
 	await visit(params.root, 0);
 	return discovered;
@@ -1474,56 +1319,25 @@ async function discoverPluginDirs(codexHome) {
 		const manifestPath = path.join(dir, ".codex-plugin", "plugin.json");
 		if (await exists(manifestPath)) {
 			const manifest = await readJsonObject(manifestPath);
-			const manifestName = typeof manifest.name === "string" ? manifest.name.trim() : "";
+			const name = (typeof manifest.name === "string" ? manifest.name.trim() : "") || path.basename(dir);
 			discovered.set(dir, {
-				name: manifestName || path.basename(dir),
+				name,
 				source: dir,
+				manifestPath,
+				sourceKind: "cache",
 				migratable: false,
 				message: "Cached Codex plugin bundle found. Review manually unless the plugin is also installed in the source Codex app-server inventory"
 			});
 			return;
 		}
-		for (const entry of await safeReadDir(dir)) if (entry.isDirectory()) await visit(path.join(dir, entry.name), depth + 1);
+		for (const entry of await safeReadDir(dir)) {
+			if (!entry.isDirectory()) continue;
+			await visit(path.join(dir, entry.name), depth + 1);
+		}
 	}
 	await visit(root, 0);
 	return [...discovered.values()].toSorted((a, b) => a.source.localeCompare(b.source));
 }
-async function discoverCodexMemoryFile(candidate) {
-	try {
-		const stat = await fs.lstat(candidate.path);
-		if (stat.isSymbolicLink()) throw new Error(`Codex memory source must not be a symbolic link: ${candidate.path}`);
-		if (!stat.isFile()) throw new Error(`Codex memory source must be a regular file: ${candidate.path}`);
-		return candidate;
-	} catch (error) {
-		if (error && typeof error === "object" && "code" in error && error.code === "ENOENT") return;
-		throw error;
-	}
-}
-async function discoverCodexMemorySources(codexHome) {
-	const memoriesDir = path.join(codexHome, "memories");
-	return (await Promise.all([{
-		id: "memory:codex:MEMORY.md",
-		label: "Codex consolidated memory",
-		name: "MEMORY.md"
-	}, {
-		id: "memory:codex:memory_summary.md",
-		label: "Codex memory summary",
-		name: "memory_summary.md"
-	}].map(async (candidate) => await discoverCodexMemoryFile({
-		id: candidate.id,
-		label: candidate.label,
-		path: path.join(memoriesDir, candidate.name)
-	})))).filter((entry) => entry !== void 0);
-}
-//#endregion
-//#region extensions/codex/src/migration/source.ts
-function defaultCodexHome() {
-	const configuredHome = process.env.CODEX_HOME;
-	return resolveHomePath(configuredHome !== void 0 && configuredHome.length > 0 ? configuredHome : "~/.codex");
-}
-function personalAgentsSkillsDir() {
-	return path.join(resolveUserHomeDir(), ".agents", "skills");
-}
 async function discoverInstalledCuratedPlugins(codexHome, options = {}) {
 	const requestOptions = { startOptions: sourceCodexAppServerStartOptions(codexHome) };
 	try {
@@ -1554,7 +1368,6 @@ function sourceCodexAppServerStartOptions(codexHome) {
 		transport: "stdio",
 		command: "codex",
 		commandSource: "managed",
-		managedCommandOrder: "desktop-first",
 		args: [
 			"app-server",
 			"--listen",
@@ -1585,6 +1398,7 @@ function buildInstalledPluginSource(plugin) {
 		pluginName,
 		marketplaceName: CODEX_PLUGINS_MARKETPLACE_NAME,
 		source: `${CODEX_PLUGINS_MARKETPLACE_NAME}/${pluginName}`,
+		sourceKind: "app-server",
 		migratable: true,
 		installed: plugin.installed,
 		enabled: plugin.enabled
@@ -1791,7 +1605,8 @@ function pluginNameFromSummary(summary) {
 		if (normalized) return normalized;
 	}
 }
-async function discoverCodexSource(options = {}) {
+async function discoverCodexSource(inputOrOptions) {
+	const options = typeof inputOrOptions === "string" || inputOrOptions === void 0 ? { input: inputOrOptions } : inputOrOptions;
 	const codexHome = resolveHomePath(options.input?.trim() || defaultCodexHome());
 	const codexSkillsDir = path.join(codexHome, "skills");
 	const agentsSkillsDir = personalAgentsSkillsDir();
@@ -1799,39 +1614,38 @@ async function discoverCodexSource(options = {}) {
 	const authPath = path.join(codexHome, "auth.json");
 	const modelsCachePath = path.join(codexHome, "models_cache.json");
 	const hooksPath = path.join(codexHome, "hooks", "hooks.json");
-	const memoryFiles = await discoverCodexMemorySources(codexHome);
-	const codexSkills = options.memoryOnly ? [] : await discoverSkillDirs({
+	const codexSkills = await discoverSkillDirs({
 		root: codexSkillsDir,
 		sourceLabel: "Codex skill",
 		excludeSystem: true
 	});
-	const personalAgentSkills = options.memoryOnly ? [] : await discoverSkillDirs({
+	const personalAgentSkills = await discoverSkillDirs({
 		root: agentsSkillsDir,
 		sourceLabel: "personal AgentSkill"
 	});
-	const sourcePluginDiscovery = options.memoryOnly ? { plugins: [] } : await discoverInstalledCuratedPlugins(codexHome, options);
+	const sourcePluginDiscovery = await discoverInstalledCuratedPlugins(codexHome, options);
 	const sourcePluginNames = new Set(sourcePluginDiscovery.plugins.flatMap((plugin) => plugin.pluginName ? [plugin.pluginName] : []));
-	const cachedPlugins = (options.memoryOnly ? [] : await discoverPluginDirs(codexHome)).filter((plugin) => {
+	const cachedPlugins = (await discoverPluginDirs(codexHome)).filter((plugin) => {
 		const normalizedName = sanitizePluginName(plugin.name);
 		return !sourcePluginNames.has(normalizedName);
 	});
 	const plugins = [...sourcePluginDiscovery.plugins, ...cachedPlugins].toSorted((a, b) => a.source.localeCompare(b.source));
 	const archivePaths = [];
-	if (!options.memoryOnly && await exists(configPath)) archivePaths.push({
+	if (await exists(configPath)) archivePaths.push({
 		id: "archive:config.toml",
 		path: configPath,
 		relativePath: "config.toml",
 		message: "Codex config is archived for manual review; it is not activated automatically"
 	});
-	if (!options.memoryOnly && await exists(hooksPath)) archivePaths.push({
+	if (await exists(hooksPath)) archivePaths.push({
 		id: "archive:hooks/hooks.json",
 		path: hooksPath,
 		relativePath: "hooks/hooks.json",
 		message: "Codex native hooks are archived for manual review because they can execute commands"
 	});
 	const skills = [...codexSkills, ...personalAgentSkills].toSorted((a, b) => a.source.localeCompare(b.source));
-	const hasAuth = !options.memoryOnly && await exists(authPath);
-	const high = Boolean(memoryFiles.length || codexSkills.length || plugins.length || archivePaths.length || hasAuth);
+	const hasAuth = await exists(authPath);
+	const high = Boolean(codexSkills.length || plugins.length || archivePaths.length || hasAuth);
 	const medium = personalAgentSkills.length > 0;
 	return {
 		root: codexHome,
@@ -1839,9 +1653,10 @@ async function discoverCodexSource(options = {}) {
 		codexHome,
 		...await isDirectory(codexSkillsDir) ? { codexSkillsDir } : {},
 		...await isDirectory(agentsSkillsDir) ? { personalAgentsSkillsDir: agentsSkillsDir } : {},
+		...await exists(configPath) ? { configPath } : {},
 		...hasAuth ? { authPath } : {},
 		...await exists(modelsCachePath) ? { modelsCachePath } : {},
-		memoryFiles,
+		...await exists(hooksPath) ? { hooksPath } : {},
 		skills,
 		plugins,
 		...sourcePluginDiscovery.error ? { pluginDiscoveryError: sourcePluginDiscovery.error } : {},
@@ -1858,7 +1673,7 @@ function sanitizePluginName(value) {
 //#region extensions/codex/src/migration/targets.ts
 function resolveCodexMigrationTargets(ctx) {
 	const cfg = ctx.config;
-	const agentId = ctx.targetAgentId ?? resolveDefaultAgentId(cfg);
+	const agentId = resolveDefaultAgentId(cfg);
 	const workspaceDir = resolveAgentWorkspaceDir(cfg, agentId);
 	const configuredAgentDir = resolveAgentConfig(cfg, agentId)?.agentDir?.trim();
 	return {
@@ -1889,52 +1704,6 @@ const CODEX_PLUGIN_NATIVE_CONFIG_PATH = [
 ];
 const MIGRATION_REASON_PLUGIN_EXISTS = "plugin exists";
 const CODEX_PLUGIN_SOURCE_APP_VERIFICATION_UNVERIFIED = "not_run";
-const MIGRATION_REASON_TARGET_NOT_REGULAR = "target is not a regular file";
-async function lstatIfExists(filePath) {
-	try {
-		return await fs.lstat(filePath);
-	} catch (error) {
-		const code = extractErrorCode(error);
-		if (code === "ENOENT" || code === "ENOTDIR") return;
-		throw error;
-	}
-}
-async function buildCodexMemoryItems(params) {
-	const items = [];
-	for (const memory of params.memoryFiles) {
-		const target = path.join(params.workspaceDir, "memory", "imports", "codex", path.basename(memory.path));
-		const targetStat = await lstatIfExists(target);
-		const targetNotRegular = targetStat !== void 0 && !targetStat.isFile();
-		if (!targetNotRegular) {
-			const [source, workspace, destination] = await Promise.all([
-				fs.realpath(path.dirname(memory.path)),
-				canonicalPathFromExistingAncestor(params.workspaceDir),
-				canonicalPathFromExistingAncestor(target)
-			]);
-			if (!isPathInside(workspace, destination)) throw new Error("Codex memory import destination must stay in the selected workspace.");
-			if (isPathInside(source, destination) || isPathInside(destination, source)) throw new Error("Codex memory source and OpenClaw import destination must be separate paths.");
-		}
-		const targetConflict = targetStat !== void 0 && !params.overwrite;
-		items.push(createMigrationItem({
-			id: memory.id,
-			kind: "memory",
-			action: "copy",
-			source: memory.path,
-			target,
-			status: targetNotRegular || targetConflict ? "conflict" : "planned",
-			reason: targetNotRegular ? MIGRATION_REASON_TARGET_NOT_REGULAR : targetConflict ? MIGRATION_REASON_TARGET_EXISTS : void 0,
-			message: "Copy consolidated Codex memory into the OpenClaw memory index.",
-			details: {
-				sourceType: "codex-memory",
-				sourceLabel: memory.label,
-				collectionId: "codex",
-				collectionLabel: "Codex",
-				relativePath: path.basename(memory.path)
-			}
-		}));
-	}
-	return items;
-}
 function uniqueSkillName(skill, counts) {
 	const base = sanitizeName(skill.name) || "codex-skill";
 	if ((counts.get(base) ?? 0) <= 1) return base;
@@ -1944,43 +1713,49 @@ function uniqueSkillName(skill, counts) {
 		base
 	].filter(Boolean).join("-")) || base;
 }
-async function buildCodexSkillItems(params) {
-	const counts = /* @__PURE__ */ new Map();
+async function buildSkillItems(params) {
+	const baseCounts = /* @__PURE__ */ new Map();
 	for (const skill of params.skills) {
 		const base = sanitizeName(skill.name) || "codex-skill";
-		counts.set(base, (counts.get(base) ?? 0) + 1);
+		baseCounts.set(base, (baseCounts.get(base) ?? 0) + 1);
 	}
+	const resolvedCounts = /* @__PURE__ */ new Map();
 	const planned = params.skills.map((skill) => {
-		const name = uniqueSkillName(skill, counts);
+		const name = uniqueSkillName(skill, baseCounts);
+		resolvedCounts.set(name, (resolvedCounts.get(name) ?? 0) + 1);
 		return {
 			skill,
 			name,
 			target: path.join(params.workspaceDir, "skills", name)
 		};
 	});
-	const resolvedCounts = planned.reduce((resolved, item) => {
-		resolved.set(item.name, (resolved.get(item.name) ?? 0) + 1);
-		return resolved;
-	}, /* @__PURE__ */ new Map());
-	return await Promise.all(planned.map(async (item) => {
-		const collision = (resolvedCounts.get(item.name) ?? 0) > 1;
+	const items = [];
+	for (const item of planned) {
+		const collides = (resolvedCounts.get(item.name) ?? 0) > 1;
 		const targetExists = await exists(item.target);
-		const conflict = collision || targetExists && !params.overwrite;
-		return createMigrationItem({
+		items.push(createMigrationItem({
 			id: `skill:${item.name}`,
 			kind: "skill",
 			action: "copy",
 			source: item.skill.source,
 			target: item.target,
-			status: conflict ? "conflict" : "planned",
-			reason: collision ? `multiple Codex skills normalize to "${item.name}"` : conflict ? MIGRATION_REASON_TARGET_EXISTS : void 0,
+			status: collides ? "conflict" : targetExists && !params.overwrite ? "conflict" : "planned",
+			reason: collides ? `multiple Codex skills normalize to "${item.name}"` : targetExists && !params.overwrite ? MIGRATION_REASON_TARGET_EXISTS : void 0,
 			message: `Copy ${item.skill.sourceLabel} into this OpenClaw agent workspace.`,
 			details: {
 				skillName: item.name,
 				sourceLabel: item.skill.sourceLabel
 			}
-		});
-	}));
+		}));
+	}
+	return items;
+}
+function uniquePluginConfigKey(plugin, counts, usedCounts) {
+	const base = sanitizeName(plugin.pluginName ?? plugin.name) || "codex-plugin";
+	if ((counts.get(base) ?? 0) <= 1) return base;
+	const next = (usedCounts.get(base) ?? 0) + 1;
+	usedCounts.set(base, next);
+	return sanitizeName(`${base}-${next}`) || base;
 }
 function readExistingCodexPluginEntries(config) {
 	const entries = readMigrationConfigPath(config, [...CODEX_PLUGIN_NATIVE_CONFIG_PATH, "plugins"]);
@@ -2011,12 +1786,18 @@ function readExistingPluginAllowDestructiveActions(existing, pluginName) {
 	return normalized === "auto" || normalized === "ask" ? normalized : void 0;
 }
 function buildPluginItems(ctx, plugins) {
+	const baseCounts = /* @__PURE__ */ new Map();
+	for (const plugin of plugins.filter((entry) => entry.migratable)) {
+		const base = sanitizeName(plugin.pluginName ?? plugin.name) || "codex-plugin";
+		baseCounts.set(base, (baseCounts.get(base) ?? 0) + 1);
+	}
 	const existingPluginEntries = readExistingCodexPluginEntries(ctx.config);
+	const usedCounts = /* @__PURE__ */ new Map();
 	let manualIndex = 0;
 	const items = [];
 	for (const plugin of plugins) {
 		if (plugin.migratable && plugin.marketplaceName === "openai-curated" && plugin.pluginName) {
-			const configKey = plugin.pluginName;
+			const configKey = uniquePluginConfigKey(plugin, baseCounts, usedCounts);
 			const plannedEntry = {
 				enabled: true,
 				marketplaceName: CODEX_PLUGINS_MARKETPLACE_NAME,
@@ -2033,7 +1814,6 @@ function buildPluginItems(ctx, plugins) {
 				action: "install",
 				status: conflict ? "conflict" : "planned",
 				reason: conflict ? MIGRATION_REASON_PLUGIN_EXISTS : void 0,
-				applyPhase: "after-promotion",
 				source: plugin.source,
 				target: `plugins.entries.codex.config.codexPlugins.plugins.${configKey}`,
 				message: `Install Codex plugin "${plugin.pluginName}" in the OpenClaw-managed Codex app-server runtime.`,
@@ -2051,6 +1831,12 @@ function buildPluginItems(ctx, plugins) {
 		}
 		manualIndex += 1;
 		if (plugin.migrationBlock && plugin.pluginName) {
+			const details = {
+				pluginName: plugin.pluginName,
+				marketplaceName: CODEX_PLUGINS_MARKETPLACE_NAME,
+				...plugin.migrationBlock.apps ? { apps: plugin.migrationBlock.apps } : {},
+				...plugin.migrationBlock.error ? { error: plugin.migrationBlock.error } : {}
+			};
 			items.push(createMigrationItem({
 				id: `plugin:${sanitizeName(plugin.name) || sanitizeName(path.basename(plugin.source))}:${manualIndex}`,
 				kind: "manual",
@@ -2059,12 +1845,7 @@ function buildPluginItems(ctx, plugins) {
 				status: "skipped",
 				reason: plugin.migrationBlock.code,
 				message: plugin.message ?? `Codex native plugin "${plugin.name}" was found but not activated automatically.`,
-				details: {
-					pluginName: plugin.pluginName,
-					marketplaceName: CODEX_PLUGINS_MARKETPLACE_NAME,
-					...plugin.migrationBlock.apps ? { apps: plugin.migrationBlock.apps } : {},
-					...plugin.migrationBlock.error ? { error: plugin.migrationBlock.error } : {}
-				}
+				details: { ...details }
 			}));
 			continue;
 		}
@@ -2072,7 +1853,7 @@ function buildPluginItems(ctx, plugins) {
 			id: `plugin:${sanitizeName(plugin.name) || sanitizeName(path.basename(plugin.source))}:${manualIndex}`,
 			source: plugin.source,
 			message: plugin.message ?? `Codex native plugin "${plugin.name}" was found but not activated automatically.`,
-			recommendation: "Review the plugin bundle first, then install trusted compatible plugins with openclaw plugins install <path> --force."
+			recommendation: "Review the plugin bundle first, then install trusted compatible plugins with openclaw plugins install <path>."
 		}));
 	}
 	return items;
@@ -2102,6 +1883,7 @@ function normalizeExistingAllowDestructiveActions(value) {
 	return asBoolean(value);
 }
 function readExistingPluginPolicyRepairs(config) {
+	if (config === void 0) return {};
 	return Object.fromEntries(Object.entries(readExistingCodexPluginEntries(config)).flatMap(([configKey, entry]) => {
 		const pluginEntry = isRecord(entry) ? entry : void 0;
 		if (pluginEntry?.allow_destructive_actions !== "on-request") return [];
@@ -2111,9 +1893,9 @@ function readExistingPluginPolicyRepairs(config) {
 		}]];
 	}));
 }
-function buildCodexPluginsConfigValue(entries, config) {
+function buildCodexPluginsConfigValue(entries, params = {}) {
 	const plugins = {
-		...readExistingPluginPolicyRepairs(config),
+		...readExistingPluginPolicyRepairs(params.config),
 		...Object.fromEntries(entries.toSorted((a, b) => a.configKey.localeCompare(b.configKey)).map((entry) => [entry.configKey, {
 			enabled: entry.enabled,
 			marketplaceName: CODEX_PLUGINS_MARKETPLACE_NAME,
@@ -2125,7 +1907,7 @@ function buildCodexPluginsConfigValue(entries, config) {
 		enabled: true,
 		config: { codexPlugins: {
 			enabled: true,
-			allow_destructive_actions: readExistingAllowDestructiveActions(config) ?? true,
+			allow_destructive_actions: params.config === void 0 ? true : readExistingAllowDestructiveActions(params.config) ?? true,
 			plugins
 		} }
 	};
@@ -2152,7 +1934,7 @@ function hasCodexPluginConfigConflict(config, value) {
 function buildPluginConfigItem(ctx, pluginItems) {
 	const entries = pluginItems.filter((item) => item.status === "planned").map((item) => readCodexPluginMigrationConfigEntry(item, true)).filter((entry) => entry !== void 0);
 	if (entries.length === 0) return;
-	const value = buildCodexPluginsConfigValue(entries, ctx.config);
+	const value = buildCodexPluginsConfigValue(entries, { config: ctx.config });
 	const conflict = !ctx.overwrite && hasCodexPluginConfigConflict(ctx.config, value);
 	return createMigrationItem({
 		id: CODEX_PLUGIN_CONFIG_ITEM_ID,
@@ -2161,7 +1943,6 @@ function buildPluginConfigItem(ctx, pluginItems) {
 		target: "plugins.entries.codex.config.codexPlugins",
 		status: conflict ? "conflict" : "planned",
 		reason: conflict ? MIGRATION_REASON_TARGET_EXISTS : void 0,
-		applyPhase: "after-promotion",
 		message: "Enable OpenClaw's Codex plugin integration and record migrated source-installed curated plugins.",
 		details: {
 			path: [...CODEX_PLUGIN_CONFIG_PATH],
@@ -2171,44 +1952,35 @@ function buildPluginConfigItem(ctx, pluginItems) {
 }
 async function buildCodexMigrationPlan(ctx) {
 	const targets = resolveCodexMigrationTargets(ctx);
-	const memoryOnly = ctx.itemKinds !== void 0 && ctx.itemKinds.length > 0 && ctx.itemKinds.every((kind) => kind === "memory");
 	const source = await discoverCodexSource({
 		input: ctx.source,
-		memoryOnly,
-		evaluatePluginMigrationEligibility: !memoryOnly,
+		evaluatePluginMigrationEligibility: true,
 		verifyPluginApps: shouldVerifyPluginApps(ctx)
 	});
 	if (!hasCodexSource(source)) throw new Error(`Codex state was not found at ${source.root}. Pass --from <path> if it lives elsewhere.`);
 	const items = [];
-	items.push(...await buildCodexMemoryItems({
-		memoryFiles: source.memoryFiles,
+	items.push(...await buildCodexAuthItems({
+		ctx,
+		source,
+		targets
+	}));
+	items.push(...await buildSkillItems({
+		skills: source.skills,
 		workspaceDir: targets.workspaceDir,
 		overwrite: ctx.overwrite
 	}));
-	if (!memoryOnly) {
-		items.push(...await buildCodexAuthItems({
-			ctx,
-			source,
-			targets
-		}));
-		items.push(...await buildCodexSkillItems({
-			skills: source.skills,
-			workspaceDir: targets.workspaceDir,
-			overwrite: ctx.overwrite
-		}));
-		const pluginItems = buildPluginItems(ctx, source.plugins);
-		items.push(...pluginItems);
-		const pluginConfigItem = buildPluginConfigItem(ctx, pluginItems);
-		if (pluginConfigItem) items.push(pluginConfigItem);
-		for (const archivePath of source.archivePaths) items.push(createMigrationItem({
-			id: archivePath.id,
-			kind: "archive",
-			action: "archive",
-			source: archivePath.path,
-			message: archivePath.message ?? "Archived in the migration report for manual review; not imported into live config.",
-			details: { archiveRelativePath: archivePath.relativePath }
-		}));
-	}
+	const pluginItems = buildPluginItems(ctx, source.plugins);
+	items.push(...pluginItems);
+	const pluginConfigItem = buildPluginConfigItem(ctx, pluginItems);
+	if (pluginConfigItem) items.push(pluginConfigItem);
+	for (const archivePath of source.archivePaths) items.push(createMigrationItem({
+		id: archivePath.id,
+		kind: "archive",
+		action: "archive",
+		source: archivePath.path,
+		message: archivePath.message ?? "Archived in the migration report for manual review; not imported into live config.",
+		details: { archiveRelativePath: archivePath.relativePath }
+	}));
 	const warnings = [
 		...!ctx.includeSecrets && items.some((item) => item.kind === "auth") ? ["Auth credentials were detected but skipped. Re-run interactively or pass --include-secrets to import supported credentials."] : [],
 		...items.some((item) => item.status === "conflict") ? ["Conflicts were found. Re-run with --overwrite to replace conflicting migration targets after item-level backups."] : [],
@@ -2222,7 +1994,7 @@ async function buildCodexMigrationPlan(ctx) {
 		summary: summarizeMigrationItems(items),
 		items,
 		warnings,
-		nextSteps: memoryOnly ? [] : ["Run openclaw doctor after applying the migration.", "Review skipped or auth-required Codex plugin/config/hook items before exposing them in OpenClaw sessions."],
+		nextSteps: ["Run openclaw doctor after applying the migration.", "Review skipped or auth-required Codex plugin/config/hook items before exposing them in OpenClaw sessions."],
 		metadata: {
 			agentDir: targets.agentDir,
 			codexHome: source.codexHome,
@@ -2278,9 +2050,14 @@ async function applyCodexMigrationPlan(params) {
 	const targets = resolveCodexMigrationTargets(params.ctx);
 	const codexHome = typeof plan.metadata?.codexHome === "string" && plan.metadata.codexHome.trim() ? plan.metadata.codexHome : plan.source;
 	const authSource = {
+		root: plan.source,
+		confidence: "high",
 		codexHome,
 		authPath: path.join(codexHome, "auth.json"),
-		modelsCachePath: path.join(codexHome, "models_cache.json")
+		modelsCachePath: path.join(codexHome, "models_cache.json"),
+		skills: [],
+		plugins: [],
+		archivePaths: []
 	};
 	const runtime = withCachedMigrationConfigRuntime(params.ctx.runtime ?? params.runtime, params.ctx.config);
 	const applyCtx = {
@@ -2293,19 +2070,22 @@ async function applyCodexMigrationPlan(params) {
 			continue;
 		}
 		if (item.id === "config:codex-plugins") items.push(await applyCodexPluginConfigItem(applyCtx, item, items));
-		else if (item.kind === "auth") items.push(...await applyCodexAuthItems({
-			ctx: applyCtx,
-			item,
-			source: authSource,
-			targets
-		}));
-		else if (item.kind === "plugin" && item.action === "install") items.push(await applyCodexPluginInstallItem(applyCtx, item));
+		else if (item.kind === "auth") {
+			const authItem = await applyCodexAuthItem({
+				ctx: applyCtx,
+				item,
+				source: authSource,
+				targets
+			});
+			items.push(authItem);
+			items.push(...await buildCodexAuthConfigPatchItems({
+				ctx: applyCtx,
+				item: authItem,
+				source: authSource
+			}));
+		} else if (item.kind === "plugin" && item.action === "install") items.push(await applyCodexPluginInstallItem(applyCtx, item));
 		else if (item.kind === "manual") items.push(applyMigrationManualItem(item));
 		else if (item.action === "archive") items.push(await archiveMigrationItem(item, reportDir));
-		else if (item.kind === "memory") items.push(await copyMemoryMigrationFileItem(item, reportDir, {
-			workspaceDir: targets.workspaceDir,
-			overwrite: params.ctx.overwrite
-		}));
 		else items.push(await copyMigrationFileItem(item, reportDir, { overwrite: params.ctx.overwrite }));
 	}
 	const result = {
@@ -2437,7 +2217,8 @@ async function requestTargetCodexAppServerJson(params) {
 		});
 		if (hasOpenAiCuratedMarketplace(lastResponse)) return lastResponse;
 		if (Date.now() >= discoveryDeadline) return lastResponse;
-		await sleep(Math.min(TARGET_CODEX_MARKETPLACE_DISCOVERY_POLL_MS, discoveryDeadline - Date.now()));
+		const waitMs = Math.min(TARGET_CODEX_MARKETPLACE_DISCOVERY_POLL_MS, discoveryDeadline - Date.now());
+		await sleep(waitMs);
 	} while (Date.now() < discoveryDeadline);
 	return lastResponse;
 }
@@ -2476,21 +2257,13 @@ async function buildTargetCodexPluginAppCacheKey(ctx) {
 	});
 }
 async function applyCodexPluginConfigItem(ctx, item, appliedItems) {
-	if (appliedItems.filter((candidate) => candidate.kind === "plugin" && candidate.action === "install" && readCodexPluginPolicy(candidate) !== void 0 && !isCodexPluginConfigTerminal(candidate)).length > 0) return {
-		...item,
-		status: "warning",
-		reason: "selected Codex plugin activation is incomplete"
-	};
 	const entries = appliedItems.map(readAppliedPluginConfigEntry).filter((entry) => entry !== void 0);
-	if (entries.length === 0) return {
-		...markMigrationItemSkipped(item, "no selected Codex plugins"),
-		deferredCompletion: true
-	};
+	if (entries.length === 0) return markMigrationItemSkipped(item, "no selected Codex plugins");
 	const returnPatch = shouldReturnCodexPluginConfigPatch(ctx);
-	const configApi = resolveMigrationConfigRuntime(ctx);
+	const configApi = ctx.runtime?.config;
 	const currentConfig = returnPatch ? ctx.config : configApi?.current?.();
 	if (!currentConfig) return markMigrationItemError(item, "config runtime unavailable");
-	const value = buildCodexPluginsConfigValue(entries, currentConfig);
+	const value = buildCodexPluginsConfigValue(entries, { config: currentConfig });
 	if (!ctx.overwrite && hasCodexPluginConfigConflict(currentConfig, value)) return markMigrationItemConflict(item, MIGRATION_REASON_TARGET_EXISTS);
 	const migratedItem = {
 		...item,
@@ -2518,42 +2291,65 @@ async function applyCodexPluginConfigItem(ctx, item, appliedItems) {
 		return markMigrationItemError(item, error instanceof Error ? error.message : String(error));
 	}
 }
-function isCodexPluginConfigTerminal(item) {
-	return item.status === "migrated" || item.status === "skipped" && (item.deferredCompletion === true || item.reason === CODEX_PLUGIN_NOT_SELECTED_REASON || item.reason === CODEX_PLUGIN_AUTH_REQUIRED_REASON);
-}
 function readAppliedPluginConfigEntry(item) {
-	if (item.status === "migrated" || item.deferredCompletion === true) return readCodexPluginMigrationConfigEntry(item, true);
-	if (item.status === "skipped" && item.reason === CODEX_PLUGIN_AUTH_REQUIRED_REASON) return readCodexPluginMigrationConfigEntry(item, false);
+	if (item.status === "migrated") return readCodexPluginMigrationConfigEntry(item, true);
+	if (item.status === "skipped" && item.reason !== CODEX_PLUGIN_NOT_SELECTED_REASON && item.reason === CODEX_PLUGIN_AUTH_REQUIRED_REASON) return readCodexPluginMigrationConfigEntry(item, false);
 }
 function readCodexPluginPolicy(item) {
-	const entry = readCodexPluginMigrationConfigEntry(item, true);
-	if (!entry) return;
+	const configKey = item.details?.configKey;
+	const marketplaceName = item.details?.marketplaceName;
+	const pluginName = item.details?.pluginName;
+	if (typeof configKey !== "string" || marketplaceName !== "openai-curated" || typeof pluginName !== "string") return;
 	return {
-		configKey: entry.configKey,
+		configKey,
 		marketplaceName: CODEX_PLUGINS_MARKETPLACE_NAME,
-		pluginName: entry.pluginName,
+		pluginName,
 		enabled: true,
 		allowDestructiveActions: true,
 		destructiveApprovalMode: "allow"
 	};
 }
-//#endregion
-//#region extensions/codex/src/migration/provider.ts
-function isMemoryOnlyMigration(ctx) {
-	return Boolean(ctx.itemKinds && ctx.itemKinds.length > 0 && ctx.itemKinds.every((kind) => kind === "memory"));
-}
-function buildCodexMigrationProvider(params = {}) {
-	return {
-		id: "codex",
+function codexPluginActivationReportState(result) {
+	switch (result.reason) {
+		case "already_active":
+		case "installed": return {
+			installed: true,
+			enabled: true
+		};
+		case "auth_required": return {
+			installed: true,
+			enabled: false
+		};
+		case "disabled":
+		case "marketplace_missing":
+		case "plugin_missing": return {
+			installed: false,
+			enabled: false
+		};
+		case "refresh_failed": return {
+			installed: true,
+			enabled: false
+		};
+	}
+	return result.reason;
+}
+function sanitizeAppsNeedingAuth(apps) {
+	return apps.map((app) => ({
+		id: app.id,
+		name: app.name,
+		needsAuth: app.needsAuth
+	}));
+}
+//#endregion
+//#region extensions/codex/src/migration/provider.ts
+function buildCodexMigrationProvider(params = {}) {
+	return {
+		id: "codex",
 		label: "Codex",
-		description: "Import Codex memory and skills while keeping Codex native plugins and hooks explicit.",
-		supportedItemKinds: ["memory"],
+		description: "Inventory and promote Codex CLI skills while keeping Codex native plugins and hooks explicit.",
 		async detect(ctx) {
-			const source = await discoverCodexSource({
-				input: ctx.source,
-				memoryOnly: isMemoryOnlyMigration(ctx)
-			});
-			const found = isMemoryOnlyMigration(ctx) ? source.memoryFiles.length > 0 : hasCodexSource(source);
+			const source = await discoverCodexSource({ input: ctx.source });
+			const found = hasCodexSource(source);
 			return {
 				found,
 				source: source.root,
@@ -2563,9 +2359,7 @@ function buildCodexMigrationProvider(params = {}) {
 			};
 		},
 		plan: buildCodexMigrationPlan,
-		deferredApply: { retrySafe: true },
 		prepareApply(ctx) {
-			if (isMemoryOnlyMigration(ctx)) return;
 			return prepareTargetCodexAppServer(ctx);
 		},
 		async apply(ctx, plan) {
@@ -2627,7 +2421,7 @@ const CodexThreadsParamsSchema = Type.Union([
 	ArchiveParamsSchema,
 	UnarchiveParamsSchema
 ]);
-function asRecord$1(value) {
+function asRecord(value) {
 	return value && typeof value === "object" && !Array.isArray(value) ? value : {};
 }
 function readBoolean(value, fallback = false) {
@@ -2646,9 +2440,13 @@ function resolveToolSession(context, runtime) {
 	});
 	const sessionId = context.sessionId?.trim() || entry?.sessionId?.trim();
 	if (!sessionId) return;
+	const storePath = runtime.agent.session.resolveStorePath(void 0, { agentId: context.agentId });
 	return {
 		sessionId,
-		modelSelectionLocked: isModelSelectionLocked(entry)
+		sessionFile: runtime.agent.session.resolveSessionFilePath(sessionId, entry, {
+			agentId: context.agentId,
+			sessionsDir: path.dirname(storePath)
+		})
 	};
 }
 function readThreadId(params) {
@@ -2661,106 +2459,42 @@ function readThreadStatusType(value) {
 	if (!isJsonObject(value) || !isJsonObject(value.thread) || !isJsonObject(value.thread.status)) return;
 	return typeof value.thread.status.type === "string" ? value.thread.status.type : void 0;
 }
-function assertThreadMayBeArchived(value, expectedThreadId) {
-	if (!isJsonObject(value) || !isJsonObject(value.thread)) throw new Error("Codex app-server returned an invalid thread/read response");
-	if (value.thread.id !== expectedThreadId) throw new Error("Codex app-server returned a different thread than requested");
-	const status = readThreadStatusType(value);
-	if (status === "active") throw new Error("cannot archive an active Codex thread; wait for its turn to finish");
-	if (status !== "idle" && status !== "notLoaded") throw new Error("cannot verify that the Codex thread is idle; refusing to archive");
-}
-function assertThreadMayBeForked(value, expectedThreadId) {
-	if (!isJsonObject(value) || !isJsonObject(value.thread)) throw new Error("Codex app-server returned an invalid thread/read response");
-	if (value.thread.id !== expectedThreadId) throw new Error("Codex app-server returned a different thread than requested");
-	const status = readThreadStatusType(value);
-	if (status !== "idle" && status !== "notLoaded") throw new Error("cannot fork a Codex thread unless it is idle or not loaded");
-}
-function redactNativeThreadTranscriptFields(value) {
-	if (!isJsonObject(value)) return value;
-	const redacted = { ...value };
-	delete redacted.preview;
-	delete redacted.turns;
-	return redacted;
-}
-function redactNativeThreadResponse(value) {
-	if (!isJsonObject(value)) return value;
-	const redacted = { ...value };
-	if (Array.isArray(redacted.data)) redacted.data = redacted.data.map(redactNativeThreadTranscriptFields);
-	if (isJsonObject(redacted.thread)) redacted.thread = redactNativeThreadTranscriptFields(redacted.thread);
-	return redacted;
-}
-/** Builds the native Codex thread tool only for owner runs with native-home access. */
+/** Builds the native Codex thread tool only for owner runs in shared-user-home mode. */
 function createCodexThreadsTool(options) {
 	if (options.context.senderIsOwner !== true) return null;
-	const configured = readCodexPluginConfig(options.getPluginConfig());
-	if (configured.appServer?.homeScope !== "user" && configured.supervision?.enabled !== true) return null;
+	if (readCodexPluginConfig(options.getPluginConfig()).appServer?.homeScope !== "user") return null;
 	const request = options.request ?? codexControlRequest;
-	const runtimeConfig = () => options.context.getRuntimeConfig?.() ?? options.context.runtimeConfig ?? options.context.config;
-	const baseRequestOptions = () => ({
+	const requestOptions = () => ({
 		agentDir: options.context.agentDir,
-		config: runtimeConfig(),
+		config: options.context.getRuntimeConfig?.() ?? options.context.runtimeConfig ?? options.context.config,
 		sessionId: options.context.sessionId,
 		sessionKey: options.context.sessionKey
 	});
 	const currentSession = () => resolveToolSession(options.context, options.runtime);
-	const currentIdentity = (sessionId) => sessionBindingIdentity({
-		sessionId,
-		sessionKey: options.context.sessionKey,
-		agentId: options.context.agentId,
-		config: runtimeConfig()
-	});
-	const currentBinding = async (session) => session ? await options.bindingStore.read(currentIdentity(session.sessionId)) : void 0;
-	const requestOptions = async (pluginConfig) => {
-		const plugin = readCodexPluginConfig(pluginConfig);
-		const session = currentSession();
-		const binding = await currentBinding(session);
-		if (binding?.connectionScope === "supervision") {
-			const connection = resolveCodexBindingAppServerConnection({
-				binding,
-				pluginConfig
-			});
-			return {
-				...baseRequestOptions(),
-				startOptions: connection.appServer.start,
-				authProfileId: connection.clientAuthProfileId
-			};
-		}
-		if (plugin.appServer?.homeScope === "user") {
-			const connection = resolveCodexBindingAppServerConnection({
-				binding,
-				pluginConfig
-			});
-			return {
-				...baseRequestOptions(),
-				startOptions: connection.appServer.start,
-				authProfileId: null
-			};
-		}
-		if (plugin.supervision?.enabled !== true) throw new Error("Codex native thread access is disabled for this run.");
-		return {
-			...baseRequestOptions(),
-			startOptions: resolveCodexSupervisionAppServerRuntimeOptions({ pluginConfig }).start,
-			authProfileId: null
-		};
+	const currentIdentity = (sessionId) => {
+		return sessionBindingIdentity({
+			sessionId,
+			sessionKey: options.context.sessionKey,
+			agentId: options.context.agentId,
+			config: requestOptions().config
+		});
 	};
+	const currentBinding = async (session) => session ? await options.bindingStore.read(currentIdentity(session.sessionId)) : void 0;
 	return {
 		name: "codex_threads",
 		label: "Codex Threads",
-		description: "Manage native Codex threads: list, read, fork, rename, archive (confirm:true), unarchive. When supervision is enabled, raw transcript reads and every mutation require their matching supervision policy option.",
+		description: "List, read, fork, rename, archive, or restore native Codex threads. Fork to continue a thread safely across Codex clients; do not resume the same thread from two clients.",
 		parameters: CodexThreadsParamsSchema,
 		async execute(_toolCallId, rawParams) {
-			const params = asRecord$1(rawParams);
+			const params = asRecord(rawParams);
 			const action = readStringParam(params, "action", {
 				required: true,
 				label: "action"
 			});
 			const pluginConfig = options.getPluginConfig();
-			const plugin = readCodexPluginConfig(pluginConfig);
-			const supervision = plugin.supervision;
-			const mayReadRawTranscripts = supervision?.enabled !== true || supervision.allowRawTranscripts === true;
 			if (action === "list") {
 				const cursor = readStringParam(params, "cursor");
 				const searchTerm = readStringParam(params, "search");
-				if (searchTerm && !mayReadRawTranscripts) throw new Error("Codex native thread search is disabled while raw transcript access is disabled.");
 				const response = await request(pluginConfig, CODEX_CONTROL_METHODS.listThreads, {
 					archived: readBoolean(params.archived),
 					limit: readLimit(params.limit) ?? 20,
@@ -2770,20 +2504,17 @@ function createCodexThreadsTool(options) {
 					sourceKinds: [...CODEX_INTERACTIVE_THREAD_SOURCE_KINDS],
 					...cursor ? { cursor } : {},
 					...searchTerm ? { searchTerm } : {}
-				}, await requestOptions(pluginConfig));
-				return jsonResult(mayReadRawTranscripts ? response : redactNativeThreadResponse(response));
+				}, requestOptions());
+				return jsonResult(response);
 			}
 			const threadId = readThreadId(params);
 			if (action === "read") {
-				const includeTurns = readBoolean(params.include_turns);
-				if (includeTurns && !mayReadRawTranscripts) throw new Error("Codex raw transcript reads are disabled for this codex plugin supervision config.");
 				const response = await request(pluginConfig, CODEX_CONTROL_METHODS.readThread, {
 					threadId,
-					includeTurns
-				}, await requestOptions(pluginConfig));
-				return jsonResult(mayReadRawTranscripts ? response : redactNativeThreadResponse(response));
+					includeTurns: readBoolean(params.include_turns)
+				}, requestOptions());
+				return jsonResult(response);
 			}
-			if ((action === "fork" || action === "rename" || action === "archive" || action === "unarchive") && supervision?.enabled === true && supervision.allowWriteControls !== true) throw new Error("Codex native thread mutations are disabled for this codex plugin supervision config.");
 			if (action === "rename") {
 				const name = readStringParam(params, "name", {
 					required: true,
@@ -2792,7 +2523,7 @@ function createCodexThreadsTool(options) {
 				await request(pluginConfig, CODEX_CONTROL_METHODS.renameThread, {
 					threadId,
 					name
-				}, await requestOptions(pluginConfig));
+				}, requestOptions());
 				return jsonResult({
 					action,
 					threadId,
@@ -2800,42 +2531,23 @@ function createCodexThreadsTool(options) {
 				});
 			}
 			if (action === "unarchive") {
-				const response = await request(pluginConfig, CODEX_CONTROL_METHODS.unarchiveThread, { threadId }, await requestOptions(pluginConfig));
-				return jsonResult(mayReadRawTranscripts ? response : redactNativeThreadResponse(response));
+				const response = await request(pluginConfig, CODEX_CONTROL_METHODS.unarchiveThread, { threadId }, requestOptions());
+				return jsonResult(response);
 			}
 			const session = currentSession();
 			const binding = await currentBinding(session);
 			if (action === "archive") {
 				if (params.confirm !== true) throw new Error("confirm=true is required to archive a native Codex thread");
-				if (!session) throw new Error("cannot safely archive a native Codex thread without a session identity");
-				const identity = currentIdentity(session.sessionId);
-				await options.bindingStore.withThreadArchiveFence(async () => {
-					const archivedBinding = await currentBinding(session);
-					if (archivedBinding?.threadId === threadId) {
-						if (session.modelSelectionLocked) throw new ModelSelectionLockedError();
-						assertCodexBindingMayBeReplaced(archivedBinding, "archiving its bound native thread");
-					}
-					assertThreadMayBeArchived(await request(pluginConfig, CODEX_CONTROL_METHODS.readThread, {
+				if (binding?.threadId === threadId) {
+					if (readThreadStatusType(await request(pluginConfig, CODEX_CONTROL_METHODS.readThread, {
 						threadId,
 						includeTurns: false
-					}, await requestOptions(pluginConfig)), threadId);
-					if (await options.bindingStore.hasOtherThreadOwner(threadId, identity)) throw new Error("cannot archive a native Codex thread owned by another OpenClaw session");
-					await assertCodexArchiveDescendantsUnowned({
-						bindingStore: options.bindingStore,
-						threadId,
-						listPage: async (listParams) => await request(pluginConfig, CODEX_CONTROL_METHODS.listThreads, listParams, await requestOptions(pluginConfig)),
-						assertDescendantIdle: async (descendantThreadId) => {
-							assertThreadMayBeArchived(await request(pluginConfig, CODEX_CONTROL_METHODS.readThread, {
-								threadId: descendantThreadId,
-								includeTurns: false
-							}, await requestOptions(pluginConfig)), descendantThreadId);
-						}
-					});
-					await request(pluginConfig, CODEX_CONTROL_METHODS.archiveThread, { threadId }, await requestOptions(pluginConfig));
-					if (archivedBinding?.threadId === threadId) await options.bindingStore.mutate(identity, {
-						kind: "clear",
-						threadId
-					});
+					}, requestOptions())) === "active") throw new Error("cannot archive the Codex thread active in this OpenClaw session");
+				}
+				await request(pluginConfig, CODEX_CONTROL_METHODS.archiveThread, { threadId }, requestOptions());
+				if (session && binding?.threadId === threadId) await options.bindingStore.mutate(currentIdentity(session.sessionId), {
+					kind: "clear",
+					threadId
 				});
 				return jsonResult({
 					action,
@@ -2845,21 +2557,16 @@ function createCodexThreadsTool(options) {
 			if (action !== "fork") throw new Error(`unsupported codex_threads action: ${action}`);
 			const attach = readBoolean(params.attach, true);
 			if (attach && !session) throw new Error("cannot attach a Codex fork without an active OpenClaw session");
-			if (attach && session?.modelSelectionLocked) throw new ModelSelectionLockedError();
-			const usesSupervisionConnection = binding?.connectionScope === "supervision" || plugin.appServer?.homeScope !== "user" && supervision?.enabled === true;
-			if (attach && usesSupervisionConnection) throw new Error("Supervised Codex forks must stay detached; set attach=false.");
-			if (attach) {
-				assertCodexBindingMayBeReplaced(binding, "attaching a different native fork");
-				assertThreadMayBeForked(await request(pluginConfig, CODEX_CONTROL_METHODS.readThread, {
+			if (attach && binding?.threadId === threadId) {
+				if (readThreadStatusType(await request(pluginConfig, CODEX_CONTROL_METHODS.readThread, {
 					threadId,
 					includeTurns: false
-				}, await requestOptions(pluginConfig)), threadId);
+				}, requestOptions())) === "active") throw new Error("cannot replace the Codex thread active in this OpenClaw turn");
 			}
 			const response = await request(pluginConfig, CODEX_CONTROL_METHODS.forkThread, {
 				threadId,
-				threadSource: "user",
-				excludeTurns: true
-			}, await requestOptions(pluginConfig));
+				threadSource: "user"
+			}, requestOptions());
 			if (!isJsonObject(response) || !isJsonObject(response.thread)) throw new Error("Codex app-server returned an invalid thread/fork response");
 			const forkThreadId = typeof response.thread.id === "string" && response.thread.id.trim() ? response.thread.id : void 0;
 			if (!forkThreadId) throw new Error("Codex app-server thread/fork response did not include a thread id");
@@ -2875,802 +2582,18 @@ function createCodexThreadsTool(options) {
 					}
 				})) throw new Error("Codex session binding changed before the fork could be attached");
 			}
-			const result = {
+			return jsonResult({
 				action,
 				sourceThreadId: threadId,
 				thread: response.thread,
 				attached: attach
-			};
-			return jsonResult(mayReadRawTranscripts ? result : redactNativeThreadResponse(result));
-		}
-	};
-}
-//#endregion
-//#region extensions/codex/src/supervision-tools.ts
-/**
-* Compatibility tools for the retired Codex Supervisor plugin.
-*
-* Read operations and active-turn controls use the Codex plugin's canonical
-* shared app-server client. Idle threads are never resumed or started here:
-* continuation belongs to the Codex harness, which installs approval and tool
-* handlers before it starts or resumes the harness-owned Codex thread.
-*/
-/** Legacy endpoint env retained for the shipped Supervisor tool contract. */
-const LEGACY_CODEX_SUPERVISOR_ENDPOINTS_ENV = "OPENCLAW_CODEX_SUPERVISOR_ENDPOINTS";
-/** Legacy standalone-MCP transcript gate. Agent tools use canonical config. */
-const LEGACY_CODEX_SUPERVISOR_RAW_TRANSCRIPTS_ENV = "OPENCLAW_CODEX_SUPERVISOR_ALLOW_RAW_TRANSCRIPTS";
-/** Legacy standalone-MCP write gate. Agent tools use canonical config. */
-const LEGACY_CODEX_SUPERVISOR_WRITE_CONTROLS_ENV = "OPENCLAW_CODEX_SUPERVISOR_ALLOW_WRITE_CONTROLS";
-const CODEX_SUPERVISION_COMPAT_TOOL_NAMES = [
-	"codex_endpoint_probe",
-	"codex_sessions_list",
-	"codex_session_read",
-	"codex_session_send",
-	"codex_session_interrupt"
-];
-const EmptyParamsSchema = Type.Object({}, { additionalProperties: false });
-const SessionsListParamsSchema = Type.Object({
-	include_stored: Type.Optional(Type.Boolean()),
-	max_stored_sessions: Type.Optional(Type.Integer({
-		minimum: 1,
-		maximum: 1e3
-	}))
-}, { additionalProperties: false });
-const SessionReadParamsSchema = Type.Object({
-	endpoint_id: Type.Optional(Type.String()),
-	thread_id: Type.String(),
-	include_turns: Type.Optional(Type.Boolean())
-}, { additionalProperties: false });
-const SessionSendParamsSchema = Type.Object({
-	endpoint_id: Type.Optional(Type.String()),
-	thread_id: Type.String(),
-	text: Type.String(),
-	mode: Type.Optional(Type.Union([
-		Type.Literal("auto"),
-		Type.Literal("start"),
-		Type.Literal("steer")
-	]))
-}, { additionalProperties: false });
-const SessionInterruptParamsSchema = Type.Object({
-	endpoint_id: Type.Optional(Type.String()),
-	thread_id: Type.String(),
-	turn_id: Type.Optional(Type.String())
-}, { additionalProperties: false });
-const ALL_CODEX_THREAD_SOURCE_KINDS = [
-	"cli",
-	"vscode",
-	"exec",
-	"appServer",
-	"subAgent",
-	"subAgentReview",
-	"subAgentCompact",
-	"subAgentThreadSpawn",
-	"subAgentOther",
-	"unknown"
-];
-const DEFAULT_MAX_STORED_SESSIONS = 200;
-const PAGE_LIMIT = 100;
-const MAX_COMPAT_PAGINATION_PAGES = 100;
-const MAX_COMPAT_CURSOR_LENGTH = 4096;
-const MAX_COMPAT_THREAD_ID_LENGTH = 4096;
-var CodexSupervisionPolicyError = class extends Error {};
-function asRecord(value) {
-	return isRecord(value) ? value : {};
-}
-function asRecordArray(value) {
-	return Array.isArray(value) ? value.filter(isRecord) : [];
-}
-function readCompatNextCursor(value, method) {
-	if (value === null || value === void 0) return;
-	if (typeof value !== "string" || value.trim().length === 0 || value.length > MAX_COMPAT_CURSOR_LENGTH) throw new Error(`Codex ${method} returned an invalid nextCursor`);
-	return value;
-}
-function readCompatThreadId(value, method, index) {
-	if (typeof value !== "string" || value.trim().length === 0 || value.length > MAX_COMPAT_THREAD_ID_LENGTH) throw new Error(`Codex ${method} returned an invalid thread id at data[${index}]`);
-	return value;
-}
-function readLoadedThreadIds(data) {
-	if (data.length > PAGE_LIMIT) throw new Error(`Codex thread/loaded/list returned more than ${PAGE_LIMIT} entries`);
-	return data.map((entry, index) => readCompatThreadId(entry, "thread/loaded/list", index));
-}
-function readStoredThreads(data, maxEntries) {
-	if (data.length > maxEntries) throw new Error(`Codex thread/list returned more than ${maxEntries} entries`);
-	return data.map((entry, index) => {
-		if (!isRecord(entry)) throw new Error(`Codex thread/list returned an invalid entry at data[${index}]`);
-		readCompatThreadId(entry.id, "thread/list", index);
-		return entry;
-	});
-}
-function readBooleanParam(params, key) {
-	return params[key] === true;
-}
-function readIntegerParam(params, key) {
-	const value = params[key];
-	if (value === void 0) return;
-	if (typeof value !== "number" || !Number.isInteger(value)) throw new Error(`${key} must be an integer`);
-	if (value < 1 || value > 1e3) throw new Error(`${key} must be between 1 and 1000`);
-	return value;
-}
-function readModeParam(params) {
-	const mode = readStringParam(params, "mode");
-	if (!mode) return;
-	if (mode === "auto" || mode === "start" || mode === "steer") return mode;
-	throw new Error("mode must be auto, start, or steer");
-}
-function normalizeEndpointId(value, index) {
-	const trimmed = value.trim();
-	return trimmed ? trimmed.replace(/[^a-zA-Z0-9_.:-]/g, "-") : `endpoint-${index + 1}`;
-}
-function normalizeConfiguredEndpoint(endpoint, index) {
-	return {
-		id: normalizeEndpointId(endpoint.id ?? endpoint.label ?? "", index),
-		...endpoint.label?.trim() ? { label: endpoint.label.trim() } : {},
-		configured: endpoint
-	};
-}
-function parseEndpointRecord(value) {
-	if (!isRecord(value)) return;
-	const transport = typeof value.transport === "string" ? value.transport : void 0;
-	const common = {
-		...typeof value.id === "string" ? { id: value.id } : {},
-		...typeof value.label === "string" ? { label: value.label } : {}
-	};
-	if (transport === "websocket" && typeof value.url === "string") return {
-		...common,
-		transport,
-		url: value.url,
-		...typeof value.authTokenEnv === "string" ? { authTokenEnv: value.authTokenEnv } : {}
-	};
-	if (transport === "stdio-proxy" || transport === void 0) {
-		const args = Array.isArray(value.args) ? value.args.filter((entry) => typeof entry === "string") : void 0;
-		return {
-			...common,
-			transport: "stdio-proxy",
-			...typeof value.command === "string" ? { command: value.command } : {},
-			...args && args.length > 0 ? { args } : {},
-			...typeof value.cwd === "string" ? { cwd: value.cwd } : {}
-		};
-	}
-}
-function endpointFromToken(token, index) {
-	const trimmed = token.trim();
-	if (!trimmed) return;
-	if (trimmed.startsWith("ws://") || trimmed.startsWith("wss://") || trimmed.startsWith("unix://")) return {
-		id: normalizeEndpointId("", index),
-		transport: "websocket",
-		url: trimmed
-	};
-	if (trimmed === "local" || trimmed === "proxy" || trimmed === "stdio") return {
-		id: "local",
-		label: "local Codex app-server",
-		transport: "stdio-proxy"
-	};
-	const separatorIndex = trimmed.indexOf("=");
-	const id = separatorIndex >= 0 ? trimmed.slice(0, separatorIndex) : trimmed;
-	const url = separatorIndex >= 0 ? trimmed.slice(separatorIndex + 1) : void 0;
-	if (url?.startsWith("ws://") || url?.startsWith("wss://") || url?.startsWith("unix://")) return {
-		id: normalizeEndpointId(id, index),
-		transport: "websocket",
-		url
-	};
-}
-function requireUniqueEndpointIds(endpoints) {
-	const seen = /* @__PURE__ */ new Set();
-	for (const endpoint of endpoints) {
-		if (seen.has(endpoint.id)) throw new Error(`duplicate Codex supervisor endpoint id: ${endpoint.id}`);
-		seen.add(endpoint.id);
-	}
-	return endpoints;
-}
-function readLegacyEnvEndpoints(env) {
-	const raw = env[LEGACY_CODEX_SUPERVISOR_ENDPOINTS_ENV]?.trim();
-	if (!raw) return;
-	if (raw.startsWith("[")) {
-		const parsed = JSON.parse(raw);
-		if (!Array.isArray(parsed)) throw new Error(`${LEGACY_CODEX_SUPERVISOR_ENDPOINTS_ENV} must be a JSON array`);
-		return parsed.map((entry) => parseEndpointRecord(entry)).filter((entry) => Boolean(entry));
-	}
-	return raw.split(",").map(endpointFromToken).filter((entry) => Boolean(entry));
-}
-function resolveEndpoints(pluginConfig, env, runtimeConfig) {
-	const configured = readCodexPluginConfig(pluginConfig).supervision?.endpoints;
-	const endpoints = configured?.length ? configured : readLegacyEnvEndpoints(env);
-	return (endpoints ? requireUniqueEndpointIds(endpoints.map(normalizeConfiguredEndpoint)) : [{
-		id: "local",
-		label: "local Codex app-server"
-	}]).map((endpoint) => {
-		const resolved = {
-			id: endpoint.id,
-			connectionKey: supervisionEndpointConnectionKey({
-				endpoint,
-				pluginConfig,
-				env,
-				runtimeConfig
-			})
-		};
-		if (endpoint.label !== void 0) resolved.label = endpoint.label;
-		if (endpoint.configured !== void 0) resolved.configured = endpoint.configured;
-		return resolved;
-	});
-}
-function resolveEndpointStartOptions(params) {
-	const base = resolveCodexSupervisionAppServerRuntimeOptions({
-		pluginConfig: params.pluginConfig,
-		env: params.env
-	}).start;
-	const configured = params.endpoint.configured;
-	if (!configured) return base;
-	if (!("url" in configured)) return {
-		transport: "stdio",
-		homeScope: "user",
-		command: configured.command?.trim() || "codex",
-		commandSource: "config",
-		args: configured.args?.length ? [...configured.args] : [
-			"app-server",
-			"--listen",
-			"stdio://"
-		],
-		...configured.cwd !== void 0 ? { cwd: configured.cwd } : {},
-		headers: {}
-	};
-	const tokenEnv = configured.authTokenEnv?.trim();
-	const authToken = tokenEnv ? params.env[tokenEnv]?.trim() : void 0;
-	const startOptions = {
-		transport: configured.url.startsWith("unix://") ? "unix" : "websocket",
-		...configured.url.startsWith("unix://") ? { homeScope: "user" } : {},
-		command: base.command,
-		...base.commandSource ? { commandSource: base.commandSource } : {},
-		...base.managedFallbackCommandPaths ? { managedFallbackCommandPaths: [...base.managedFallbackCommandPaths] } : {},
-		args: [...base.args],
-		url: configured.url,
-		...authToken ? { authToken } : {},
-		headers: {}
-	};
-	if (params.validateSecurity !== false) assertCodexAppServerConnectionSecurity(startOptions);
-	return startOptions;
-}
-function supervisionEndpointConnectionKey(params) {
-	const startOptions = resolveEndpointStartOptions({
-		...params,
-		validateSecurity: false
-	});
-	const usesNativeAuth = params.endpoint.configured !== void 0 || startOptions.homeScope === "user";
-	const agentDir = usesNativeAuth ? void 0 : resolveDefaultAgentDir(params.runtimeConfig ?? {});
-	const authProfileId = usesNativeAuth ? void 0 : resolveCodexAppServerAuthProfileIdForAgent({
-		agentDir,
-		config: params.runtimeConfig
-	});
-	const fallbackApiKeyCacheKey = authProfileId ? void 0 : resolveCodexAppServerFallbackApiKeyCacheKey({ startOptions });
-	return JSON.stringify({
-		homeScope: startOptions.homeScope ?? null,
-		startOptions: codexAppServerStartOptionsKey(startOptions, {
-			authProfileId,
-			agentDir,
-			fallbackApiKeyCacheKey
-		})
-	});
-}
-function createCanonicalEndpointRequest(options) {
-	return async (endpoint, method, requestParams) => {
-		const pluginConfig = options.getPluginConfig();
-		const env = options.env ?? process.env;
-		const runtime = resolveCodexSupervisionAppServerRuntimeOptions({
-			pluginConfig,
-			env
-		});
-		const config = options.getRuntimeConfig?.();
-		const startOptions = resolveEndpointStartOptions({
-			endpoint,
-			pluginConfig,
-			env
-		});
-		return await requestCodexAppServerJson({
-			method,
-			requestParams,
-			timeoutMs: runtime.requestTimeoutMs,
-			startOptions,
-			...endpoint.configured || startOptions.homeScope === "user" ? { authProfileId: null } : {},
-			...config ? { config } : {}
-		});
-	};
-}
-function statusType(thread) {
-	const status = isRecord(thread.status) ? thread.status.type : thread.status;
-	return typeof status === "string" ? status : "unknown";
-}
-function sourceLabel(value) {
-	if (typeof value === "string") return value;
-	if (!isRecord(value)) return;
-	if (typeof value.custom === "string") return `custom:${value.custom}`;
-	return Object.keys(value).toSorted()[0];
-}
-function toSession(endpointId, thread, humanAttached) {
-	if (typeof thread.id !== "string") return;
-	const source = sourceLabel(thread.source);
-	return {
-		endpointId,
-		threadId: thread.id,
-		status: statusType(thread),
-		...typeof thread.sessionId === "string" ? { sessionId: thread.sessionId } : {},
-		...typeof thread.cwd === "string" ? { cwd: thread.cwd } : {},
-		...typeof thread.preview === "string" ? { preview: thread.preview } : {},
-		...typeof thread.name === "string" || thread.name === null ? { name: thread.name } : {},
-		...source ? { source } : {},
-		...typeof thread.updatedAt === "number" ? { updatedAt: thread.updatedAt } : {},
-		...humanAttached !== void 0 ? { humanAttached } : {}
-	};
-}
-function threadFromRead(value) {
-	return isRecord(value) && isRecord(value.thread) ? value.thread : void 0;
-}
-function isLoadedThreadReadMiss(error) {
-	const message = error instanceof Error ? error.message : String(error);
-	return message.includes("thread not found") || message.includes("thread not loaded");
-}
-async function readThread(params) {
-	try {
-		const thread = threadFromRead(await params.request(params.endpoint, "thread/read", {
-			threadId: params.threadId,
-			includeTurns: params.includeTurns
-		}));
-		if (!thread) throw new Error("Codex thread/read returned an invalid response");
-		return thread;
-	} catch (error) {
-		if (!params.includeTurns || !String(error).includes("not materialized yet")) throw error;
-		const thread = threadFromRead(await params.request(params.endpoint, "thread/read", {
-			threadId: params.threadId,
-			includeTurns: false
-		}));
-		if (!thread) throw new Error("Codex thread/read returned an invalid response", { cause: error });
-		return thread;
-	}
-}
-async function listLoadedSessions(request, endpoint) {
-	const sessions = [];
-	const seenCursors = /* @__PURE__ */ new Set();
-	let cursor;
-	for (let pageIndex = 0; pageIndex < MAX_COMPAT_PAGINATION_PAGES; pageIndex += 1) {
-		const listed = await request(endpoint, "thread/loaded/list", {
-			limit: PAGE_LIMIT,
-			...cursor ? { cursor } : {}
-		});
-		if (!isRecord(listed) || !Array.isArray(listed.data)) throw new Error("Codex thread/loaded/list returned an invalid response");
-		const threadIds = readLoadedThreadIds(listed.data);
-		for (const threadId of threadIds) {
-			if (sessions.some((entry) => entry.threadId === threadId)) continue;
-			try {
-				const thread = await readThread({
-					request,
-					endpoint,
-					threadId,
-					includeTurns: false
-				});
-				const session = toSession(endpoint.id, thread, true);
-				if (session) sessions.push(session);
-			} catch (error) {
-				if (!isLoadedThreadReadMiss(error)) throw error;
-			}
-		}
-		const nextCursor = readCompatNextCursor(listed.nextCursor, "thread/loaded/list");
-		if (nextCursor && seenCursors.has(nextCursor)) throw new Error(`Codex thread/loaded/list returned repeated cursor ${nextCursor}`);
-		if (nextCursor) seenCursors.add(nextCursor);
-		cursor = nextCursor;
-		if (!cursor) break;
-	}
-	if (cursor) throw new Error(`Codex thread/loaded/list exceeded ${MAX_COMPAT_PAGINATION_PAGES} pages with a continuation cursor`);
-	return sessions;
-}
-async function listStoredSessions(params) {
-	const sessions = [];
-	const seenCursors = /* @__PURE__ */ new Set();
-	let cursor;
-	for (let pageIndex = 0; pageIndex < MAX_COMPAT_PAGINATION_PAGES; pageIndex += 1) {
-		const remaining = params.limit - sessions.length;
-		if (remaining <= 0) break;
-		const pageLimit = Math.min(PAGE_LIMIT, remaining);
-		const listed = await params.request(params.endpoint, "thread/list", {
-			archived: false,
-			limit: pageLimit,
-			sourceKinds: [...ALL_CODEX_THREAD_SOURCE_KINDS],
-			modelProviders: [],
-			sortKey: "recency_at",
-			sortDirection: "desc",
-			useStateDbOnly: true,
-			...cursor ? { cursor } : {}
-		});
-		if (!isRecord(listed) || !Array.isArray(listed.data)) throw new Error("Codex thread/list returned an invalid response");
-		for (const thread of readStoredThreads(listed.data, pageLimit)) {
-			if (sessions.length >= params.limit) break;
-			const session = toSession(params.endpoint.id, thread);
-			if (session && !sessions.some((entry) => entry.threadId === session.threadId)) sessions.push(session);
-		}
-		const nextCursor = readCompatNextCursor(listed.nextCursor, "thread/list");
-		if (nextCursor && sessions.length < params.limit && seenCursors.has(nextCursor)) throw new Error(`Codex thread/list returned repeated cursor ${nextCursor}`);
-		if (nextCursor) seenCursors.add(nextCursor);
-		cursor = nextCursor;
-		if (!cursor || sessions.length >= params.limit) break;
-	}
-	if (cursor && sessions.length < params.limit) throw new Error(`Codex thread/list exceeded ${MAX_COMPAT_PAGINATION_PAGES} pages with a continuation cursor`);
-	return sessions;
-}
-async function listSessionSnapshot(params) {
-	const sessions = [];
-	const errors = [];
-	for (const endpoint of params.endpoints) try {
-		const loaded = await listLoadedSessions(params.request, endpoint);
-		sessions.push(...loaded);
-		if (params.includeStored) {
-			const stored = await listStoredSessions({
-				request: params.request,
-				endpoint,
-				limit: params.maxStoredSessions ?? DEFAULT_MAX_STORED_SESSIONS
 			});
-			for (const session of stored) if (!sessions.some((entry) => entry.endpointId === endpoint.id && entry.threadId === session.threadId)) sessions.push(session);
 		}
-	} catch (error) {
-		if (error instanceof CodexSupervisionPolicyError) throw error;
-		errors.push({
-			endpointId: endpoint.id,
-			ok: false,
-			detail: error instanceof Error ? error.message : String(error)
-		});
-	}
-	return {
-		sessions,
-		errors
 	};
 }
-async function resolveEndpointForThread(params) {
-	if (params.endpointId) {
-		const endpoint = params.endpoints.find((entry) => entry.id === params.endpointId);
-		if (!endpoint) throw new Error(`Unknown Codex supervisor endpoint: ${params.endpointId}`);
-		return endpoint;
-	}
-	const matches = [];
-	for (const endpoint of params.endpoints) try {
-		if ((await readThread({
-			request: params.request,
-			endpoint,
-			threadId: params.threadId,
-			includeTurns: false
-		})).id === params.threadId) matches.push(endpoint);
-	} catch (error) {
-		if (error instanceof CodexSupervisionPolicyError) throw error;
-		if (!isLoadedThreadReadMiss(error)) continue;
-	}
-	if (matches.length === 1) return expectDefined(matches[0], "single matching Codex supervision endpoint");
-	if (matches.length > 1) throw new Error(`Codex thread id is ambiguous across endpoints: ${params.threadId}`);
-	throw new Error(`Codex thread not found: ${params.threadId}`);
-}
-function findInProgressTurnId(thread) {
-	const turns = asRecordArray(thread.turns);
-	for (const turn of turns.toReversed()) if (turn.status === "inProgress" && typeof turn.id === "string") return turn.id;
-}
-async function resolveInProgressTurnId(params) {
-	const inline = findInProgressTurnId(params.thread);
-	if (inline) return inline;
-	try {
-		const response = await params.request(params.endpoint, "thread/turns/list", {
-			threadId: params.threadId,
-			limit: 10,
-			sortDirection: "desc",
-			itemsView: "summary"
-		});
-		return isRecord(response) ? findInProgressTurnId({ turns: response.data }) : void 0;
-	} catch (error) {
-		if (error instanceof CodexSupervisionPolicyError) throw error;
-		return;
-	}
-}
-function redactString(value) {
-	return value.replace(/\b(?:sk|glpat|xox[baprs])-[-_a-zA-Z0-9]{12,}\b/g, "[redacted]").replace(/\b(?:ghp|gho|ghu|ghs)_[-_a-zA-Z0-9]{12,}\b/g, "[redacted]").replace(/\bBearer\s+[-._~+/a-zA-Z0-9]+=*/g, "Bearer [redacted]");
-}
-/** Redacts secret-bearing fields before legacy tool results leave the plugin. */
-function redactCodexSupervisionValue(value, key = "") {
-	if (typeof value === "string") return /authorization|password|secret|token|api[-_]?key/i.test(key) ? "[redacted]" : redactString(value);
-	if (Array.isArray(value)) return value.map((entry) => redactCodexSupervisionValue(entry));
-	if (!isRecord(value)) return value;
-	return Object.fromEntries(Object.entries(value).map(([entryKey, entryValue]) => [entryKey, redactCodexSupervisionValue(entryValue, entryKey)]));
-}
-function redactEndpointUrl(value) {
-	if (value.startsWith("unix://")) return "unix://";
-	try {
-		const url = new URL(value);
-		url.username = "";
-		url.password = "";
-		if (url.search) url.search = "?[redacted]";
-		return url.toString();
-	} catch {
-		return "[redacted]";
-	}
-}
-function endpointResult(endpoint, pluginConfig, env) {
-	const configured = endpoint.configured;
-	if (configured && (configured.transport === "stdio-proxy" || configured.transport === void 0)) return {
-		id: endpoint.id,
-		transport: "stdio-proxy",
-		...endpoint.label ? { label: endpoint.label } : {}
-	};
-	if (configured?.transport === "websocket") return {
-		id: endpoint.id,
-		transport: "websocket",
-		...endpoint.label ? { label: endpoint.label } : {},
-		url: redactEndpointUrl(configured.url)
-	};
-	const start = resolveCodexSupervisionAppServerRuntimeOptions({
-		pluginConfig,
-		env
-	}).start;
-	return {
-		id: endpoint.id,
-		transport: start.transport === "stdio" ? "stdio-proxy" : "websocket",
-		...endpoint.label ? { label: endpoint.label } : {},
-		...start.transport === "stdio" ? {} : { url: redactEndpointUrl(start.transport === "unix" ? start.url ?? "unix://" : start.url ?? "") }
-	};
-}
-function sanitizeSessionListResult(result, includeTranscriptDerivedFields) {
-	return {
-		sessions: result.sessions.map((session) => {
-			const sanitized = redactCodexSupervisionValue(session);
-			if (!includeTranscriptDerivedFields) {
-				delete sanitized.preview;
-				delete sanitized.name;
-			}
-			return sanitized;
-		}),
-		errors: includeTranscriptDerivedFields ? redactCodexSupervisionValue(result.errors) : result.errors.map(({ endpointId, ok }) => ({
-			endpointId,
-			ok
-		}))
-	};
-}
-function requireSupervisionEnabled(pluginConfig) {
-	if (readCodexPluginConfig(pluginConfig).supervision?.enabled !== true) throw new CodexSupervisionPolicyError("Codex supervision is disabled in the codex plugin config.");
-}
-function requireOwnerAccess(options) {
-	if (!options.senderIsOwner) throw new CodexSupervisionPolicyError("Codex supervision compatibility tools require an owner-authorized sender.");
-}
-function resolveToolPolicy(options, pluginConfig) {
-	const config = readCodexPluginConfig(pluginConfig).supervision;
-	const env = options.env ?? process.env;
-	return {
-		allowRawTranscripts: config?.allowRawTranscripts === true || options.useLegacyMcpPolicyEnv === true && env[LEGACY_CODEX_SUPERVISOR_RAW_TRANSCRIPTS_ENV] === "1",
-		allowWriteControls: config?.allowWriteControls === true || options.useLegacyMcpPolicyEnv === true && env[LEGACY_CODEX_SUPERVISOR_WRITE_CONTROLS_ENV] === "1"
-	};
-}
-function requireRawTranscriptAccess(options, pluginConfig) {
-	if (!resolveToolPolicy(options, pluginConfig).allowRawTranscripts) throw new CodexSupervisionPolicyError("Codex session reads are disabled for this codex plugin supervision config.");
-}
-function requireWriteAccess(options, pluginConfig) {
-	if (!resolveToolPolicy(options, pluginConfig).allowWriteControls) throw new CodexSupervisionPolicyError("Codex write controls are disabled for this codex plugin supervision config.");
-}
-function requireLiveToolPolicy(options, policy) {
-	requireOwnerAccess(options);
-	const pluginConfig = options.getPluginConfig();
-	requireSupervisionEnabled(pluginConfig);
-	if (policy === "raw-transcripts") requireRawTranscriptAccess(options, pluginConfig);
-	else if (policy === "write-controls") requireWriteAccess(options, pluginConfig);
-	return {
-		pluginConfig,
-		endpoints: resolveEndpoints(pluginConfig, options.env ?? process.env, options.getRuntimeConfig?.())
-	};
-}
-function requireCurrentEndpoint(options, policy, endpoint) {
-	const { endpoints } = requireLiveToolPolicy(options, policy);
-	const currentEndpoint = endpoints.find((candidate) => candidate.id === endpoint.id);
-	if (!currentEndpoint || currentEndpoint.connectionKey !== endpoint.connectionKey) throw new CodexSupervisionPolicyError(`Codex supervision endpoint ${endpoint.id} was removed or changed during the request.`);
-	return currentEndpoint;
-}
-function requireCurrentEndpointSet(options, expected) {
-	const current = requireLiveToolPolicy(options, "enabled");
-	if (!(current.endpoints.length === expected.length && expected.every((endpoint) => current.endpoints.some((candidate) => candidate.id === endpoint.id && candidate.connectionKey === endpoint.connectionKey)))) throw new CodexSupervisionPolicyError("Codex supervision endpoint configuration changed during the request.");
-	return { pluginConfig: current.pluginConfig };
-}
-function createPolicyGuardedRequest(options, request, policy) {
-	return async (endpoint, method, params) => {
-		return await request(requireCurrentEndpoint(options, policy, endpoint), method, params);
-	};
-}
-function idleContinuationError(threadId) {
-	return /* @__PURE__ */ new Error(`Codex thread ${threadId} is idle. Continue it from Codex Sessions so OpenClaw can install the Codex harness approval and tool handlers before resume.`);
-}
-/** Builds the five shipped Codex Supervisor compatibility tools. */
-function createCodexSupervisionTools(options) {
-	const baseRequest = options.request ?? createCanonicalEndpointRequest(options);
-	const request = createPolicyGuardedRequest(options, baseRequest, "enabled");
-	const rawTranscriptRequest = createPolicyGuardedRequest(options, baseRequest, "raw-transcripts");
-	const writeRequest = createPolicyGuardedRequest(options, baseRequest, "write-controls");
-	const current = () => {
-		return requireLiveToolPolicy(options, "enabled");
-	};
-	return [
-		{
-			name: "codex_endpoint_probe",
-			label: "Codex Endpoint Probe",
-			description: "Check configured Codex app-server endpoints.",
-			parameters: EmptyParamsSchema,
-			execute: async () => {
-				const { pluginConfig, endpoints } = current();
-				const health = [];
-				for (const endpoint of endpoints) try {
-					await request(endpoint, "thread/loaded/list", { limit: 1 });
-					health.push({
-						endpointId: endpoint.id,
-						ok: true
-					});
-				} catch (error) {
-					if (error instanceof CodexSupervisionPolicyError) throw error;
-					health.push({
-						endpointId: endpoint.id,
-						ok: false
-					});
-				}
-				requireCurrentEndpointSet(options, endpoints);
-				return jsonResult({
-					summary: `codex endpoints: ${health.filter((entry) => entry.ok).length}/${health.length} ok`,
-					endpoints: endpoints.map((endpoint) => endpointResult(endpoint, pluginConfig, options.env ?? process.env)),
-					health
-				});
-			}
-		},
-		{
-			name: "codex_sessions_list",
-			label: "Codex Sessions List",
-			description: "List Codex sessions visible to the OpenClaw supervisor.",
-			parameters: SessionsListParamsSchema,
-			execute: async (_toolCallId, rawParams) => {
-				const params = asRecord(rawParams);
-				const { endpoints } = current();
-				const result = await listSessionSnapshot({
-					endpoints,
-					request,
-					includeStored: readBooleanParam(params, "include_stored"),
-					maxStoredSessions: readIntegerParam(params, "max_stored_sessions")
-				});
-				const { pluginConfig } = requireCurrentEndpointSet(options, endpoints);
-				return jsonResult({
-					summary: `codex sessions: ${result.sessions.length}`,
-					...sanitizeSessionListResult(result, resolveToolPolicy(options, pluginConfig).allowRawTranscripts)
-				});
-			}
-		},
-		{
-			name: "codex_session_read",
-			label: "Codex Session Read",
-			description: "Read one Codex session transcript from app-server.",
-			parameters: SessionReadParamsSchema,
-			execute: async (_toolCallId, rawParams) => {
-				const { endpoints, pluginConfig } = current();
-				requireRawTranscriptAccess(options, pluginConfig);
-				const params = asRecord(rawParams);
-				const threadId = readStringParam(params, "thread_id", { required: true });
-				const endpoint = await resolveEndpointForThread({
-					endpoints,
-					request: rawTranscriptRequest,
-					endpointId: readStringParam(params, "endpoint_id"),
-					threadId
-				});
-				const thread = await readThread({
-					request: rawTranscriptRequest,
-					endpoint,
-					threadId,
-					includeTurns: readBooleanParam(params, "include_turns")
-				});
-				requireCurrentEndpoint(options, "raw-transcripts", endpoint);
-				return jsonResult({
-					summary: `codex session: ${threadId}`,
-					response: redactCodexSupervisionValue({ thread })
-				});
-			}
-		},
-		{
-			name: "codex_session_send",
-			label: "Codex Session Send",
-			description: "Steer an active Codex turn. Idle sessions must be continued through Codex Sessions.",
-			parameters: SessionSendParamsSchema,
-			execute: async (_toolCallId, rawParams) => {
-				const { endpoints, pluginConfig } = current();
-				requireWriteAccess(options, pluginConfig);
-				const params = asRecord(rawParams);
-				const threadId = readStringParam(params, "thread_id", { required: true });
-				const text = readStringParam(params, "text", {
-					required: true,
-					allowEmpty: false
-				});
-				if ((readModeParam(params) ?? "auto") === "start") throw idleContinuationError(threadId);
-				const endpoint = await resolveEndpointForThread({
-					endpoints,
-					request: writeRequest,
-					endpointId: readStringParam(params, "endpoint_id"),
-					threadId
-				});
-				const thread = await readThread({
-					request: writeRequest,
-					endpoint,
-					threadId,
-					includeTurns: true
-				});
-				requireCurrentEndpoint(options, "write-controls", endpoint);
-				if (statusType(thread) !== "active") throw idleContinuationError(threadId);
-				const turnId = await resolveInProgressTurnId({
-					request: writeRequest,
-					endpoint,
-					thread,
-					threadId
-				});
-				if (!turnId) throw new Error(`Codex thread ${threadId} is active but no in-progress turn is readable`);
-				await writeRequest(endpoint, "turn/steer", {
-					threadId,
-					expectedTurnId: turnId,
-					input: [{
-						type: "text",
-						text,
-						text_elements: []
-					}]
-				});
-				const result = {
-					endpointId: endpoint.id,
-					threadId,
-					mode: "steer",
-					turnId
-				};
-				return jsonResult({
-					summary: `codex steer: ${turnId}`,
-					result
-				});
-			}
-		},
-		{
-			name: "codex_session_interrupt",
-			label: "Codex Session Interrupt",
-			description: "Interrupt an active Codex turn.",
-			parameters: SessionInterruptParamsSchema,
-			execute: async (_toolCallId, rawParams) => {
-				const { endpoints, pluginConfig } = current();
-				requireWriteAccess(options, pluginConfig);
-				const params = asRecord(rawParams);
-				const threadId = readStringParam(params, "thread_id", { required: true });
-				const endpoint = await resolveEndpointForThread({
-					endpoints,
-					request: writeRequest,
-					endpointId: readStringParam(params, "endpoint_id"),
-					threadId
-				});
-				const thread = await readThread({
-					request: writeRequest,
-					endpoint,
-					threadId,
-					includeTurns: true
-				});
-				requireCurrentEndpoint(options, "write-controls", endpoint);
-				if (statusType(thread) !== "active") throw new Error(`Codex thread ${threadId} has no active turn to interrupt`);
-				const turnId = readStringParam(params, "turn_id") ?? await resolveInProgressTurnId({
-					request: writeRequest,
-					endpoint,
-					thread,
-					threadId
-				});
-				if (!turnId) throw new Error(`Codex thread ${threadId} has no readable in-progress turn`);
-				await writeRequest(endpoint, "turn/interrupt", {
-					threadId,
-					turnId
-				});
-				const result = {
-					endpointId: endpoint.id,
-					threadId,
-					turnId
-				};
-				return jsonResult({
-					summary: `codex interrupted: ${turnId}`,
-					result
-				});
-			}
-		}
-	];
-}
 //#endregion
 //#region extensions/codex/src/web-search-provider.ts
-const loadCodexWebSearchRuntime = createLazyRuntimeModule(() => import("./web-search-provider.runtime-CaQMYDbp.js"));
+const loadCodexWebSearchRuntime = createLazyRuntimeModule(() => import("./.setup/web-search-provider.runtime-Ce2zOHxW.mjs"));
 const CodexWebSearchSchema = {
 	type: "object",
 	properties: { query: {
@@ -3712,96 +2635,21 @@ const ENDED_SESSION_REASONS = /* @__PURE__ */ new Set([
 var codex_default = definePluginEntry({
 	id: "codex",
 	name: "Codex",
-	description: "Codex app-server harness and native session supervision.",
+	description: "Codex app-server harness and Codex-managed GPT model catalog.",
 	register(api) {
 		const resolveCurrentConfig = () => api.runtime.config?.current ? api.runtime.config.current() : void 0;
-		const resolvePluginConfig = (resolveConfig) => {
-			const liveConfig = resolveConfig();
-			if (!liveConfig) return api.pluginConfig;
-			const livePluginConfig = resolveLivePluginConfigObject(() => liveConfig, "codex", api.pluginConfig);
-			if (!resolveEffectiveEnableState({
-				id: "codex",
-				origin: "bundled",
-				config: normalizePluginsConfig(liveConfig.plugins),
-				rootConfig: liveConfig,
-				enabledByDefault: livePluginConfig !== void 0
-			}).enabled) return;
-			return livePluginConfig;
-		};
-		const resolveCurrentPluginConfig = () => resolvePluginConfig(resolveCurrentConfig);
-		if (api.registrationMode === "full") {
-			const realtimeBrowserSession = configureCodexRealtimeBrowserSession({
-				getConfig: resolveCurrentConfig,
-				getPluginConfig: resolveCurrentPluginConfig
-			});
-			api.registerHttpRoute({
-				path: CODEX_REALTIME_OFFER_PATH,
-				auth: "plugin",
-				match: "exact",
-				handler: realtimeBrowserSession.handler
-			});
-			api.registerService({
-				id: "codex-oauth-realtime-browser-session-warmup",
-				start: () => {
-					realtimeBrowserSession.warmup().catch((error) => {
-						api.logger.debug?.(`Codex OAuth realtime warmup unavailable: ${error instanceof Error ? error.message : String(error)}`);
-					});
-				}
-			});
-			api.lifecycle.registerRuntimeLifecycle({
-				id: "codex-oauth-realtime-browser-session",
-				description: "Release Codex OAuth realtime browser sessions when the plugin stops",
-				cleanup: async ({ reason }) => {
-					if (reason === "reset" || reason === "delete") return;
-					await realtimeBrowserSession.cleanup();
-				}
-			});
-		}
-		let bindingStateStore;
-		const openBindingStateStore = () => bindingStateStore ??= api.runtime.state.openSyncKeyedStore({
+		const resolveCurrentPluginConfig = () => resolveLivePluginConfigObject(resolveCurrentConfig, "codex", api.pluginConfig) ?? api.pluginConfig;
+		const bindingStore = createLazyCodexAppServerBindingStore(api.runtime.state.openSyncKeyedStore({
 			namespace: CODEX_APP_SERVER_BINDING_NAMESPACE,
 			maxEntries: CODEX_APP_SERVER_BINDING_MAX_ENTRIES,
 			overflowPolicy: "reject-new"
-		});
-		const bindingStore = createLazyCodexAppServerBindingStore({
-			entries: () => openBindingStateStore().entries(),
-			lookup: (key) => openBindingStateStore().lookup(key),
-			get update() {
-				const store = openBindingStateStore();
-				return store.update?.bind(store);
-			}
-		});
-		registerCodexCliMetadata(api);
-		const sessionCatalogControl = createCodexSessionCatalogControl({
-			getPluginConfig: resolveCurrentPluginConfig,
-			getRuntimeConfig: resolveCurrentConfig
-		});
-		if (readCodexPluginConfig(resolveCurrentPluginConfig()).sessionCatalog?.enabled !== false) {
-			codexSessionCatalogRuntime.register({
-				api,
-				bindingStore,
-				control: sessionCatalogControl,
-				getRuntimeConfig: resolveCurrentConfig
-			});
-			for (const command of createCodexSessionCatalogNodeHostCommands(sessionCatalogControl)) api.registerNodeHostCommand(command);
-		}
-		for (const policy of createCodexSessionCatalogNodeInvokePolicies()) api.registerNodeInvokePolicy(policy);
-		if (readCodexPluginConfig(resolveCurrentPluginConfig()).supervision?.enabled === true) api.registerTool((context) => {
-			if (context.senderIsOwner !== true) return [];
-			const resolveToolRuntimeConfig = () => context.getRuntimeConfig?.() ?? context.runtimeConfig ?? context.config ?? resolveCurrentConfig();
-			return createCodexSupervisionTools({
-				getPluginConfig: () => resolvePluginConfig(resolveToolRuntimeConfig),
-				getRuntimeConfig: resolveToolRuntimeConfig,
-				senderIsOwner: context.senderIsOwner
-			});
-		}, { names: [...CODEX_SUPERVISION_COMPAT_TOOL_NAMES] });
+		}));
 		api.registerAgentHarness(createCodexAppServerAgentHarness({
 			bindingStore,
-			sessionCatalogControl,
 			resolveConfig: resolveCurrentConfig,
-			resolvePluginConfig: resolveCurrentPluginConfig,
-			runtime: api.runtime
+			resolvePluginConfig: resolveCurrentPluginConfig
 		}));
+		api.registerProvider(buildCodexProvider({ pluginConfig: api.pluginConfig }));
 		api.registerMediaUnderstandingProvider(buildCodexMediaUnderstandingProvider({ pluginConfig: api.pluginConfig }));
 		api.registerWebSearchProvider(createCodexWebSearchProvider({ resolvePluginConfig: resolveCurrentPluginConfig }));
 		api.registerMigrationProvider(buildCodexMigrationProvider({ runtime: api.runtime }));
@@ -3872,7 +2720,7 @@ var codex_default = definePluginEntry({
 				}
 			}
 		}));
-		api.on("inbound_claim", (event, ctx) => codexConversationBindingRuntime.handleInboundClaim(event, ctx, {
+		api.on("inbound_claim", (event, ctx) => handleCodexConversationInboundClaim(event, ctx, {
 			bindingStore,
 			pluginConfig: resolveCurrentPluginConfig(),
 			config: resolveCurrentConfig(),
@@ -3881,14 +2729,14 @@ var codex_default = definePluginEntry({
 				...params
 			})
 		}));
-		api.onConversationBindingResolved?.((event) => codexConversationBindingRuntime.handleBindingResolved(event, { bindingStore }));
+		api.onConversationBindingResolved?.((event) => handleCodexConversationBindingResolved(event, { bindingStore }));
 		api.on("after_compaction", async (event, ctx) => {
 			const previousSessionId = event.previousSessionId?.trim();
 			const sessionId = ctx.sessionId?.trim();
 			if (!previousSessionId || !sessionId || previousSessionId === sessionId) return;
 			const config = resolveCurrentConfig();
 			const sessionKey = ctx.sessionKey?.trim();
-			const { sessionBindingIdentity } = await import("./session-binding-DlVQ-Pxs.js").then((n) => n.u);
+			const { sessionBindingIdentity } = await import("./.setup/session-binding-DuihlMJc.mjs").then((n) => n.c);
 			const identity = sessionBindingIdentity({
 				sessionId,
 				...sessionKey ? { sessionKey } : {},
@@ -3901,12 +2749,8 @@ var codex_default = definePluginEntry({
 		api.on("session_end", async (event, ctx) => {
 			if (!event.reason || !ENDED_SESSION_REASONS.has(event.reason)) return;
 			const sessionKey = event.sessionKey ?? ctx.sessionKey;
-			const endedSessionKey = sessionKey?.trim();
-			const nextSessionKey = event.nextSessionKey?.trim();
-			if (endedSessionKey && nextSessionKey && nextSessionKey !== endedSessionKey) return;
-			if (event.nextSessionId?.trim() === event.sessionId.trim()) return;
 			const config = resolveCurrentConfig();
-			const { sessionBindingIdentity } = await import("./session-binding-DlVQ-Pxs.js").then((n) => n.u);
+			const { sessionBindingIdentity } = await import("./.setup/session-binding-DuihlMJc.mjs").then((n) => n.c);
 			await bindingStore.retireSessionGeneration(sessionBindingIdentity({
 				sessionId: event.sessionId,
 				...sessionKey ? { sessionKey } : {},