@openclaw/codex 2026.7.2-beta.5 → 2026.8.1-beta.2

package/dist/{plugin-app-cache-key-DSXX-rXO.js → plugin-app-cache-key-C3H2CVp6.js}

@@ -1,11 +1,11 @@
-import { U as resolveCodexAppServerHomeDir } from "./shared-client-BVKE40c-.js";
-import { x as resolveCodexAppServerUserHomeDir } from "./session-binding-DlVQ-Pxs.js";
+import { A as resolveCodexAppServerUserHomeDir } from "./session-binding-DPxIvMgE.js";
+import { dt as resolveCodexAppServerLocalHomeDir, ut as resolveCodexAppServerHomeDir } from "./shared-client-kIBbGjk4.js";
 import { createRequire } from "node:module";
+import { isRecord } from "openclaw/plugin-sdk/string-coerce-runtime";
+import { readPluginPackageVersion } from "openclaw/plugin-sdk/extension-shared";
 import { isFutureDateTimestampMs, resolveDateTimestampMs, resolveExpiresAtMsFromDurationMs } from "openclaw/plugin-sdk/number-runtime";
 import { OPENCLAW_VERSION, embeddedAgentLog } from "openclaw/plugin-sdk/agent-harness-runtime";
 import { createHash } from "node:crypto";
-import { readPluginPackageVersion } from "openclaw/plugin-sdk/extension-shared";
-import { isRecord } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { truncateUtf16Safe } from "openclaw/plugin-sdk/text-utility-runtime";
 //#region extensions/codex/src/app-server/app-inventory-cache.ts
 /**
@@ -14,7 +14,7 @@ import { truncateUtf16Safe } from "openclaw/plugin-sdk/text-utility-runtime";
 */
 /** Default app inventory cache freshness window. */
 const CODEX_APP_INVENTORY_CACHE_TTL_MS = 3600 * 1e3;
-const CODEX_TARGETED_APP_INVENTORY_LIMIT = 1e3;
+const CODEX_APP_READ_BATCH_LIMIT = 100;
 const MAX_SERIALIZED_ERROR_MESSAGE_LENGTH = 500;
 /** In-memory app inventory cache with coalesced refreshes per key. */
 var CodexAppInventoryCache = class {
@@ -55,15 +55,25 @@ var CodexAppInventoryCache = class {
 	refreshNow(params) {
 		return this.refresh(params);
 	}
-	/** Marks a key stale and records the reason as a diagnostic. */
-	invalidate(key, reason, nowMs = Date.now()) {
+	/**
+	* Marks a key stale and records the reason as a diagnostic. A scope names
+	* the app ids the invalidation concerns so a covering targeted refresh can
+	* clear it; without one, only a complete refresh revalidates the entry.
+	*/
+	invalidate(key, reason, nowMs = Date.now(), invalidatedAppIds) {
 		this.revision += 1;
+		this.refreshTokens.set(key, (this.refreshTokens.get(key) ?? 0) + 1);
+		this.inFlight.delete(key);
 		const diagnostic = {
 			message: reason,
 			atMs: nowMs
 		};
 		const entry = this.entries.get(key);
 		if (entry) {
+			const scope = invalidatedAppIds?.filter(Boolean) ?? [];
+			if (!entry.invalidated) entry.invalidatedAppIds = scope.length ? [...scope].toSorted() : void 0;
+			else if (entry.invalidatedAppIds && scope.length) entry.invalidatedAppIds = Array.from(/* @__PURE__ */ new Set([...entry.invalidatedAppIds, ...scope])).toSorted();
+			else entry.invalidatedAppIds = void 0;
 			entry.invalidated = true;
 			entry.lastError = diagnostic;
 			entry.revision = this.revision;
@@ -83,42 +93,60 @@ var CodexAppInventoryCache = class {
 		return this.revision;
 	}
 	scheduleRefresh(params) {
-		if (this.inFlight.has(params.key) && !params.forceRefetch) return true;
-		const promise = this.refresh(params);
-		this.inFlight.set(params.key, promise);
-		promise.catch(() => void 0);
+		const existing = this.inFlight.get(params.key);
+		if (existing && !params.forceRefetch && doesInFlightRefreshCover(existing, params)) return true;
+		this.refresh(params).catch(() => void 0);
 		return true;
 	}
 	async refresh(params) {
 		const existing = this.inFlight.get(params.key);
-		if (existing && !params.forceRefetch) return existing;
+		if (existing && !params.forceRefetch && doesInFlightRefreshCover(existing, params)) return existing.promise;
 		const refreshToken = (this.refreshTokens.get(params.key) ?? 0) + 1;
 		this.refreshTokens.set(params.key, refreshToken);
-		const promise = this.refreshUncoalesced(params, refreshToken);
-		this.inFlight.set(params.key, promise);
+		const previousRefresh = params.forceRefetch ? void 0 : existing?.promise;
+		const promise = this.refreshUncoalesced(params, refreshToken, previousRefresh);
+		const currentRefresh = {
+			promise,
+			targetAppIds: new Set(params.targetAppIds?.filter(Boolean) ?? [])
+		};
+		this.inFlight.set(params.key, currentRefresh);
 		try {
 			return await promise;
 		} finally {
-			if (this.inFlight.get(params.key) === promise) this.inFlight.delete(params.key);
+			if (this.inFlight.get(params.key) === currentRefresh) this.inFlight.delete(params.key);
 		}
 	}
-	async refreshUncoalesced(params, refreshToken) {
+	async refreshUncoalesced(params, refreshToken, previousRefresh) {
 		const nowMs = resolveDateTimestampMs(params.nowMs);
 		try {
-			const apps = await listAllApps(params.request, params.forceRefetch ?? false, params.targetAppIds);
+			let previousRefreshSucceeded = false;
+			if (previousRefresh) try {
+				await previousRefresh;
+				previousRefreshSucceeded = true;
+			} catch {}
+			const inventory = await readInstalledApps(params.request, {
+				forceRefresh: params.forceRefetch === true || !this.entries.has(params.key) && !previousRefreshSucceeded,
+				targetAppIds: params.targetAppIds
+			});
 			this.revision += 1;
 			const expiresAtMs = resolveExpiresAtMsFromDurationMs(this.ttlMs, { nowMs }) ?? 0;
 			const snapshot = {
 				key: params.key,
-				apps,
+				apps: inventory.apps,
+				installedApps: inventory.installedApps,
+				...params.targetAppIds?.some(Boolean) ? { targetAppIds: Array.from(new Set(params.targetAppIds.filter(Boolean))).toSorted() } : {},
 				fetchedAtMs: nowMs,
 				expiresAtMs,
 				revision: this.revision
 			};
 			if (this.refreshTokens.get(params.key) === refreshToken) {
+				const existingEntry = this.entries.get(params.key);
+				const published = resolvePublishedInventorySnapshot(existingEntry, snapshot, nowMs);
+				const remaining = resolveRemainingInvalidationScope(existingEntry, snapshot);
 				this.entries.set(params.key, {
-					...snapshot,
-					invalidated: false
+					...published,
+					...remaining,
+					...remaining.invalidated && existingEntry?.lastError ? { lastError: existingEntry.lastError } : {}
 				});
 				this.diagnostics.delete(params.key);
 			}
@@ -140,6 +168,59 @@ var CodexAppInventoryCache = class {
 		}
 	}
 };
+/**
+* Publish policy for refreshed snapshots. A complete refresh replaces the
+* entry, but a targeted refresh only rewrites its own target rows in place —
+* replacing the whole entry with a narrow snapshot makes agents that share
+* the runtime identity see each other's plugin apps vanish and force a hosted
+* connector refresh per turn. The refreshed snapshot stays authoritative for
+* its target set, so target rows it no longer returns are deleted.
+*/
+function resolvePublishedInventorySnapshot(existing, snapshot, nowMs) {
+	if (!snapshot.targetAppIds?.length || !existing) return snapshot;
+	if (!isFutureDateTimestampMs(existing.expiresAtMs, { nowMs })) return snapshot;
+	const refreshedTargetIds = new Set(snapshot.targetAppIds);
+	const { targetAppIds: snapshotTargetAppIds, ...snapshotBase } = snapshot;
+	return {
+		...snapshotBase,
+		fetchedAtMs: existing.fetchedAtMs,
+		expiresAtMs: existing.expiresAtMs,
+		apps: mergeRefreshedRows(existing.apps, snapshot.apps, refreshedTargetIds),
+		installedApps: mergeRefreshedRows(existing.installedApps, snapshot.installedApps, refreshedTargetIds),
+		...existing.targetAppIds?.length ? { targetAppIds: Array.from(/* @__PURE__ */ new Set([...existing.targetAppIds, ...snapshotTargetAppIds])).toSorted() } : {}
+	};
+}
+/** Replaces refreshed target rows in place, deletes vanished ones, appends new ones. */
+function mergeRefreshedRows(existingRows, refreshedRows, refreshedTargetIds) {
+	const refreshedById = new Map(refreshedRows.map((row) => [row.id, row]));
+	const existingIds = new Set(existingRows.map((row) => row.id));
+	return [...existingRows.flatMap((row) => {
+		if (!refreshedTargetIds.has(row.id)) return [row];
+		const refreshed = refreshedById.get(row.id);
+		return refreshed ? [refreshed] : [];
+	}), ...refreshedRows.filter((row) => !existingIds.has(row.id))];
+}
+/**
+* A refresh retires exactly the invalidation scope it re-read: a complete
+* refresh clears everything; a targeted one subtracts its target ids so
+* separate covering refreshes accumulate until no scope remains. Unscoped
+* invalidations require a complete refresh.
+*/
+function resolveRemainingInvalidationScope(existing, snapshot) {
+	if (!existing?.invalidated || !snapshot.targetAppIds?.length) return { invalidated: false };
+	if (!existing.invalidatedAppIds) return { invalidated: true };
+	const refreshedTargetIds = new Set(snapshot.targetAppIds);
+	const remaining = existing.invalidatedAppIds.filter((appId) => !refreshedTargetIds.has(appId));
+	return remaining.length > 0 ? {
+		invalidated: true,
+		invalidatedAppIds: remaining
+	} : { invalidated: false };
+}
+function doesInFlightRefreshCover(existing, params) {
+	if (existing.targetAppIds.size === 0) return true;
+	const requestedAppIds = new Set(params.targetAppIds?.filter(Boolean) ?? []);
+	return requestedAppIds.size > 0 && Array.from(requestedAppIds).every((appId) => existing.targetAppIds.has(appId));
+}
 /** Serializes a refresh failure without leaking large or sensitive error data. */
 function serializeCodexAppInventoryError(error) {
 	const record = isRecord(error) ? error : void 0;
@@ -175,29 +256,41 @@ function normalizeRuntimeIdentityForCacheKey(value) {
 	}).toSorted(([left], [right]) => left.localeCompare(right));
 	return entries.length > 0 ? Object.fromEntries(entries) : null;
 }
-async function listAllApps(request, forceRefetch, targetAppIds = []) {
-	const apps = [];
-	const targetIds = new Set(targetAppIds.filter(Boolean));
-	const remainingTargetIds = new Set(targetIds);
-	const seenCursors = /* @__PURE__ */ new Set();
-	let cursor;
-	do {
-		const response = await request("app/list", {
-			cursor,
-			limit: targetIds.size > 0 ? CODEX_TARGETED_APP_INVENTORY_LIMIT : 100,
-			forceRefetch
-		});
-		apps.push(...response.data);
-		for (const app of response.data) remainingTargetIds.delete(app.id);
-		if (targetIds.size > 0 && remainingTargetIds.size === 0) break;
-		cursor = response.nextCursor;
-		if (cursor && seenCursors.has(cursor)) throw new Error(`app/list returned repeated cursor ${cursor}`);
-		if (cursor) seenCursors.add(cursor);
-	} while (cursor);
-	return apps;
+async function readInstalledApps(request, options) {
+	const installed = await request("app/installed", { forceRefresh: options.forceRefresh });
+	const targetIds = new Set((options.targetAppIds ?? []).filter(Boolean));
+	const apps = targetIds.size === 0 ? installed.apps : installed.apps.filter((app) => targetIds.has(app.id));
+	if (apps.length === 0) return {
+		apps: [],
+		installedApps: []
+	};
+	const metadataResponses = await Promise.all(Array.from({ length: Math.ceil(apps.length / CODEX_APP_READ_BATCH_LIMIT) }, (_, index) => request("app/read", { appIds: apps.slice(index * CODEX_APP_READ_BATCH_LIMIT, (index + 1) * CODEX_APP_READ_BATCH_LIMIT).map((app) => app.id) })));
+	const metadataById = new Map(metadataResponses.flatMap((response) => response.apps).map((metadata) => [metadata.id, metadata]));
+	return {
+		apps: apps.flatMap((installedApp) => {
+			const metadata = metadataById.get(installedApp.id);
+			if (!metadata) return [];
+			return [{
+				id: installedApp.id,
+				name: metadata.name,
+				description: metadata.description ?? null,
+				logoUrl: metadata.iconUrl ?? null,
+				logoUrlDark: metadata.iconUrlDark ?? null,
+				distributionChannel: metadata.distributionChannel ?? null,
+				branding: null,
+				appMetadata: null,
+				labels: null,
+				installUrl: metadata.installUrl ?? null,
+				isAccessible: true,
+				isEnabled: installedApp.enabled,
+				pluginDisplayNames: metadata.pluginDisplayNames
+			}];
+		}),
+		installedApps: apps
+	};
 }
 function stripEntryState(entry) {
-	const { invalidated: _invalidated, ...snapshot } = entry;
+	const { invalidated: _invalidated, invalidatedAppIds: _invalidatedAppIds, ...snapshot } = entry;
 	return snapshot;
 }
 function fingerprintInventoryCacheKey(key) {
@@ -277,7 +370,7 @@ function resolveCodexAppServerConnectionHome(start, agentDir) {
 	if (start.transport === "unix" && (!start.url || start.url === "unix://")) return resolveCodexAppServerUserHomeDir(start.env ?? process.env);
 	if (start.transport !== "stdio") return null;
 	if (start.homeScope === "user") return resolveCodexAppServerUserHomeDir(process.env);
-	return agentDir ? resolveCodexAppServerHomeDir(agentDir) : null;
+	return agentDir ? resolveCodexAppServerLocalHomeDir(start, agentDir) : null;
 }
 /** Serializes app-server endpoint identity, including credential fingerprints. */
 function resolveCodexPluginAppCacheEndpoint(appServer) {

package/dist/plugin-marketplace-discovery-CzrGJdCR.js

@@ -0,0 +1,385 @@
+import { P as isCodexFastServiceTier, o as isCodexAppServerNativeAuthProfile, r as bindingStoreKey, s as normalizeCodexAppServerBindingModelProvider } from "./session-binding-DPxIvMgE.js";
+import { a as getLeasedSharedCodexAppServerClient, l as releaseLeasedSharedCodexAppServerClient } from "./shared-client-kIBbGjk4.js";
+import { g as resolveCodexAppServerRequestModelSelection, v as resolveCodexBindingModelProviderFallback } from "./thread-lifecycle-Bu1BTDXr.js";
+import { r as formatCodexDisplayText } from "./command-formatters-B1AEz8ZA.js";
+import { n as resolveCodexBindingAppServerConnection } from "./binding-connection-I5Bo-AsX.js";
+import { asOptionalRecord } from "openclaw/plugin-sdk/string-coerce-runtime";
+import { resolveAgentDir } from "openclaw/plugin-sdk/agent-runtime";
+import { patchSessionEntry, resolveStorePath } from "openclaw/plugin-sdk/session-store-runtime";
+import { ModelSelectionLockedError, applyModelOverrideWithAuthProfileCompatibility } from "openclaw/plugin-sdk/model-session-runtime";
+//#region extensions/codex/src/command-authorization.ts
+const CODEX_NATIVE_EXECUTION_AUTH_ERROR = "Only an owner or operator.admin can control Codex native execution.";
+function canMutateCodexHost(ctx) {
+	return ctx.senderIsOwner === true || ctx.gatewayClientScopes?.includes("operator.admin") === true;
+}
+//#endregion
+//#region extensions/codex/src/conversation-control.ts
+const CODEX_CONVERSATION_CONTROL_STATE = Symbol.for("openclaw.codex.conversationControl");
+function getActiveTurns() {
+	const globalState = globalThis;
+	globalState[CODEX_CONVERSATION_CONTROL_STATE] ??= /* @__PURE__ */ new Map();
+	return globalState[CODEX_CONVERSATION_CONTROL_STATE];
+}
+function trackCodexConversationActiveTurn(active) {
+	const activeTurns = getActiveTurns();
+	const key = bindingStoreKey(active.identity);
+	activeTurns.set(key, active);
+	return () => {
+		if (activeTurns.get(key)?.turnId === active.turnId) activeTurns.delete(key);
+	};
+}
+function readCodexConversationActiveTurn(identity) {
+	return getActiveTurns().get(bindingStoreKey(identity));
+}
+async function stopCodexConversationTurn(params) {
+	const active = readCodexConversationActiveTurn(params.identity);
+	if (!active) return {
+		stopped: false,
+		message: "No active Codex run to stop."
+	};
+	const lookup = buildBindingLookup(params);
+	const binding = await params.bindingStore.read(params.identity);
+	if (binding?.threadId !== active.threadId) return {
+		stopped: false,
+		message: "The active Codex run no longer matches this session binding."
+	};
+	const connection = resolveCodexBindingAppServerConnection({
+		binding,
+		authProfileId: binding?.authProfileId,
+		pluginConfig: params.pluginConfig
+	});
+	const runtime = connection.appServer;
+	const client = active.client ?? await getLeasedSharedCodexAppServerClient({
+		startOptions: runtime.start,
+		timeoutMs: runtime.requestTimeoutMs,
+		authProfileId: connection.clientAuthProfileId,
+		...lookup
+	});
+	try {
+		await client.request("turn/interrupt", {
+			threadId: active.threadId,
+			turnId: active.turnId
+		}, { timeoutMs: runtime.requestTimeoutMs });
+	} finally {
+		if (!active.client) releaseLeasedSharedCodexAppServerClient(client);
+	}
+	return {
+		stopped: true,
+		message: "Codex stop requested."
+	};
+}
+async function steerCodexConversationTurn(params) {
+	const active = readCodexConversationActiveTurn(params.identity);
+	const text = params.message.trim();
+	if (!text) return {
+		steered: false,
+		message: "Usage: /codex steer <message>"
+	};
+	if (!active) return {
+		steered: false,
+		message: "No active Codex run to steer."
+	};
+	const lookup = buildBindingLookup(params);
+	const binding = await params.bindingStore.read(params.identity);
+	if (binding?.threadId !== active.threadId) return {
+		steered: false,
+		message: "The active Codex run no longer matches this session binding."
+	};
+	const connection = resolveCodexBindingAppServerConnection({
+		binding,
+		authProfileId: binding?.authProfileId,
+		pluginConfig: params.pluginConfig
+	});
+	const runtime = connection.appServer;
+	const client = active.client ?? await getLeasedSharedCodexAppServerClient({
+		startOptions: runtime.start,
+		timeoutMs: runtime.requestTimeoutMs,
+		authProfileId: connection.clientAuthProfileId,
+		...lookup
+	});
+	try {
+		await client.request("turn/steer", {
+			threadId: active.threadId,
+			expectedTurnId: active.turnId,
+			input: [{
+				type: "text",
+				text,
+				text_elements: []
+			}]
+		}, { timeoutMs: runtime.requestTimeoutMs });
+	} finally {
+		if (!active.client) releaseLeasedSharedCodexAppServerClient(client);
+	}
+	return {
+		steered: true,
+		message: "Sent steer message to Codex."
+	};
+}
+async function setCodexConversationModel(params) {
+	const model = params.model.trim();
+	if (!model) return "Usage: /codex model <model>";
+	const lookup = buildBindingLookup(params);
+	const binding = await requireThreadBinding(params.bindingStore, params.identity);
+	if (binding.connectionScope === "supervision") throw new ModelSelectionLockedError();
+	const modelSelection = resolveCodexAppServerRequestModelSelection({
+		model,
+		modelProvider: resolveConversationControlModelProvider({
+			authProfileId: binding.authProfileId,
+			bindingModel: binding.model,
+			bindingModelProvider: binding.modelProvider,
+			currentModel: model,
+			...lookup
+		}),
+		authProfileId: binding.authProfileId,
+		...lookup
+	});
+	const nextModelProvider = normalizeCodexAppServerBindingModelProvider({
+		authProfileId: binding.authProfileId,
+		modelProvider: modelSelection.modelProvider,
+		...lookup
+	});
+	const nextModel = modelSelection.model;
+	const modelChanged = nextModel !== binding.model || nextModelProvider !== binding.modelProvider;
+	const session = params.session ?? (params.identity.kind === "session" && params.identity.sessionKey ? {
+		agentId: params.identity.agentId,
+		sessionId: params.identity.sessionId,
+		sessionKey: params.identity.sessionKey
+	} : void 0);
+	if (session) {
+		if (!await patchSessionEntry({
+			agentId: session.agentId,
+			storePath: resolveStorePath(params.config?.session?.store, { agentId: session.agentId }),
+			sessionKey: session.sessionKey,
+			requireWriteSuccess: true,
+			replaceEntry: true,
+			update: (entry) => {
+				if (entry.sessionId !== session.sessionId) throw new Error("Codex session changed while applying the model selection.");
+				applyModelOverrideWithAuthProfileCompatibility({
+					cfg: params.config ?? {},
+					agentDir: params.agentDir ?? resolveAgentDir(params.config ?? {}, session.agentId),
+					entry,
+					currentProvider: binding.modelProvider ?? "openai",
+					selection: {
+						provider: nextModelProvider ?? "openai",
+						model: nextModel
+					},
+					markLiveSwitchPending: true
+				});
+				return entry;
+			}
+		})) throw new Error("Codex session changed while applying the model selection.");
+		if (params.identity.kind === "conversation") await patchThreadBinding(params.bindingStore, params.identity, binding.threadId, {
+			model: nextModel,
+			modelProvider: nextModelProvider,
+			...modelChanged && binding.contextEngine?.projection ? { contextEngine: {
+				...binding.contextEngine,
+				projection: void 0
+			} } : {}
+		});
+		else if (modelChanged && binding.contextEngine?.projection) await patchThreadBinding(params.bindingStore, params.identity, binding.threadId, { contextEngine: {
+			...binding.contextEngine,
+			projection: void 0
+		} });
+	} else await patchThreadBinding(params.bindingStore, params.identity, binding.threadId, {
+		model: nextModel,
+		modelProvider: nextModelProvider,
+		...modelChanged && binding.contextEngine?.projection ? { contextEngine: {
+			...binding.contextEngine,
+			projection: void 0
+		} } : {}
+	});
+	return `Codex model set to ${formatCodexDisplayText(nextModel)}.`;
+}
+async function setCodexConversationFastMode(params) {
+	const binding = await requireThreadBinding(params.bindingStore, params.identity);
+	if (params.enabled == null) return `Codex fast mode: ${isCodexFastServiceTier(binding.serviceTier) ? "on" : "off"}.`;
+	const serviceTier = params.enabled ? "priority" : "flex";
+	await patchThreadBinding(params.bindingStore, params.identity, binding.threadId, { serviceTier });
+	return `Codex fast mode ${params.enabled ? "enabled" : "disabled"}.`;
+}
+async function setCodexConversationPermissions(params) {
+	const binding = await requireThreadBinding(params.bindingStore, params.identity);
+	if (!params.mode) return `Codex permissions: ${formatPermissionsMode(binding)}.`;
+	const policy = permissionsForMode(params.mode);
+	await patchThreadBinding(params.bindingStore, params.identity, binding.threadId, {
+		approvalPolicy: policy.approvalPolicy,
+		sandbox: policy.sandbox
+	});
+	return `Codex permissions set to ${params.mode === "yolo" ? "full access" : "default"}.`;
+}
+function parseCodexFastModeArg(arg) {
+	const normalized = arg?.trim().toLowerCase();
+	if (!normalized || normalized === "status") return;
+	if (normalized === "on" || normalized === "true" || normalized === "fast") return true;
+	if (normalized === "off" || normalized === "false" || normalized === "flex") return false;
+}
+function parseCodexPermissionsModeArg(arg) {
+	const normalized = arg?.trim().toLowerCase();
+	if (!normalized || normalized === "status") return;
+	if (normalized === "yolo" || normalized === "full" || normalized === "full-access") return "yolo";
+	if (normalized === "default" || normalized === "guardian") return "default";
+}
+function formatPermissionsMode(binding) {
+	return binding.approvalPolicy === "never" && binding.sandbox === "danger-full-access" ? "full access" : "default";
+}
+async function requireThreadBinding(bindingStore, identity) {
+	const binding = await bindingStore.read(identity);
+	if (!binding?.threadId) throw new Error("No Codex thread is attached to this OpenClaw session yet.");
+	return binding;
+}
+async function patchThreadBinding(bindingStore, identity, threadId, patch) {
+	if (!await bindingStore.mutate(identity, {
+		kind: "patch",
+		threadId,
+		patch
+	})) throw new Error("Codex thread binding changed while applying the control update.");
+}
+function buildBindingLookup(params) {
+	const agentDir = params.agentDir?.trim();
+	return {
+		...agentDir ? { agentDir } : {},
+		...params.config ? { config: params.config } : {}
+	};
+}
+function resolveConversationControlModelProvider(params) {
+	const modelProvider = resolveCodexBindingModelProviderFallback({
+		currentModel: params.currentModel,
+		bindingModel: params.bindingModel,
+		bindingModelProvider: params.bindingModelProvider
+	})?.trim();
+	if (!modelProvider || modelProvider.toLowerCase() === "codex") return;
+	if (isCodexAppServerNativeAuthProfile(params) && modelProvider.toLowerCase() === "openai") return;
+	return modelProvider.toLowerCase() === "openai" ? "openai" : modelProvider;
+}
+function permissionsForMode(mode) {
+	return mode === "yolo" ? {
+		approvalPolicy: "never",
+		sandbox: "danger-full-access"
+	} : {
+		approvalPolicy: "on-request",
+		sandbox: "workspace-write"
+	};
+}
+//#endregion
+//#region extensions/codex/src/plugin-marketplace-discovery.ts
+/** Read-only discovery of Codex-owned local, curated, and remote plugin marketplaces. */
+const PLUGIN_SEGMENT_PATTERN = /^[A-Za-z0-9_-]+$/;
+const MAX_PLUGIN_DESCRIPTION_LENGTH = 160;
+const SUPPLEMENTAL_MARKETPLACE_KINDS = [
+	"workspace-directory",
+	"shared-with-me",
+	"created-by-me-remote",
+	"vertical"
+];
+/** Validates the same identifier segments required by Codex's stable PluginId parser. */
+function parseCodexPluginMarketplaceId(value) {
+	const separator = value.lastIndexOf("@");
+	if (separator <= 0 || separator === value.length - 1) return;
+	const pluginName = value.slice(0, separator);
+	const marketplaceName = value.slice(separator + 1);
+	return PLUGIN_SEGMENT_PATTERN.test(pluginName) && PLUGIN_SEGMENT_PATTERN.test(marketplaceName) ? {
+		pluginName,
+		marketplaceName
+	} : void 0;
+}
+/** Lists local/global first and separately requests workspace, shared, and personal catalogs. */
+async function discoverCodexMarketplacePlugins(params) {
+	const requestParams = { cwds: [params.workspaceDir] };
+	const primary = await params.request(requestParams);
+	const warnings = (primary.marketplaceLoadErrors ?? []).map((error) => boundedCatalogText(error.message));
+	const marketplaces = [...primary.marketplaces];
+	try {
+		const supplemental = await params.request({
+			...requestParams,
+			marketplaceKinds: [...SUPPLEMENTAL_MARKETPLACE_KINDS]
+		});
+		marketplaces.push(...supplemental.marketplaces);
+		warnings.push(...(supplemental.marketplaceLoadErrors ?? []).map((error) => boundedCatalogText(error.message)));
+	} catch (error) {
+		let recoveredSupplementalMarketplace = false;
+		for (const kind of SUPPLEMENTAL_MARKETPLACE_KINDS) try {
+			const supplemental = await params.request({
+				...requestParams,
+				marketplaceKinds: [kind]
+			});
+			marketplaces.push(...supplemental.marketplaces);
+			recoveredSupplementalMarketplace ||= supplemental.marketplaces.length > 0;
+			warnings.push(...(supplemental.marketplaceLoadErrors ?? []).map((loadError) => boundedCatalogText(loadError.message)));
+		} catch (kindError) {
+			warnings.push(boundedCatalogText(`${kind} marketplace unavailable: ${kindError instanceof Error ? kindError.message : String(kindError)}`));
+		}
+		if (!recoveredSupplementalMarketplace && warnings.length === 0) warnings.push(boundedCatalogText(`Additional marketplaces could not be listed: ${error instanceof Error ? error.message : String(error)}`));
+	}
+	const discovered = /* @__PURE__ */ new Map();
+	const ambiguous = /* @__PURE__ */ new Set();
+	for (const marketplace of marketplaces) {
+		if (!PLUGIN_SEGMENT_PATTERN.test(marketplace.name)) continue;
+		for (const summary of marketplace.plugins) {
+			const pluginName = pluginSlug(summary, marketplace.name);
+			if (!pluginName) continue;
+			const id = `${pluginName}@${marketplace.name}`;
+			if (ambiguous.has(id)) continue;
+			const previous = discovered.get(id);
+			const next = {
+				id,
+				pluginName,
+				marketplaceName: marketplace.name,
+				installed: summary.installed,
+				enabled: summary.enabled,
+				available: summary.availability !== "DISABLED_BY_ADMIN" && summary.installPolicy !== "NOT_AVAILABLE",
+				...summary.installPolicy ? { installPolicy: summary.installPolicy } : {},
+				...summary.authPolicy ? { authPolicy: summary.authPolicy } : {},
+				...marketplace.path ? { marketplacePath: marketplace.path } : {},
+				...summary.remotePluginId?.trim() ? {
+					remotePluginId: summary.remotePluginId.trim(),
+					mustShowInstallationInterstitial: summary.mustShowInstallationInterstitial ?? null
+				} : {},
+				summaryId: summary.id
+			};
+			const description = pluginDescription(summary);
+			if (description) next.description = description;
+			if (previous && (previous.marketplacePath !== next.marketplacePath || previous.remotePluginId !== next.remotePluginId)) {
+				discovered.delete(id);
+				ambiguous.add(id);
+				warnings.push(`Multiple discovered plugins share ${id}; installation requires a unique identity.`);
+				continue;
+			}
+			if (!previous) discovered.set(id, next);
+			else {
+				const preferred = !previous.installed && next.installed || !previous.enabled && next.installed && next.enabled ? next : previous;
+				discovered.set(id, {
+					...preferred,
+					available: previous.available && next.available,
+					...preferred.remotePluginId ? { mustShowInstallationInterstitial: previous.mustShowInstallationInterstitial === true || next.mustShowInstallationInterstitial === true ? true : previous.mustShowInstallationInterstitial === false && next.mustShowInstallationInterstitial === false ? false : null } : {},
+					...previous.installPolicy === "NOT_AVAILABLE" || next.installPolicy === "NOT_AVAILABLE" ? { installPolicy: "NOT_AVAILABLE" } : {}
+				});
+			}
+		}
+	}
+	return {
+		plugins: [...discovered.values()].toSorted((left, right) => left.id.localeCompare(right.id)),
+		warnings
+	};
+}
+function pluginSlug(summary, marketplaceName) {
+	const qualified = parseCodexPluginMarketplaceId(summary.id);
+	if (qualified?.marketplaceName === marketplaceName) return qualified.pluginName;
+	const identitySegment = summary.id.split("/").at(-1);
+	if (identitySegment && PLUGIN_SEGMENT_PATTERN.test(identitySegment)) return identitySegment;
+	return PLUGIN_SEGMENT_PATTERN.test(summary.name) ? summary.name : void 0;
+}
+function pluginDescription(summary) {
+	const description = asOptionalRecord(summary.interface)?.shortDescription;
+	if (typeof description !== "string") return;
+	return boundedCatalogText(description) || void 0;
+}
+function boundedCatalogText(value) {
+	let sanitized = "";
+	for (const character of value) {
+		const codePoint = character.codePointAt(0);
+		sanitized += codePoint !== void 0 && (codePoint <= 31 || codePoint >= 127 && codePoint <= 159) ? " " : character;
+	}
+	return sanitized.replace(/\s+/g, " ").trim().slice(0, MAX_PLUGIN_DESCRIPTION_LENGTH);
+}
+//#endregion
+export { parseCodexPermissionsModeArg as a, setCodexConversationModel as c, stopCodexConversationTurn as d, trackCodexConversationActiveTurn as f, parseCodexFastModeArg as i, setCodexConversationPermissions as l, canMutateCodexHost as m, parseCodexPluginMarketplaceId as n, readCodexConversationActiveTurn as o, CODEX_NATIVE_EXECUTION_AUTH_ERROR as p, formatPermissionsMode as r, setCodexConversationFastMode as s, discoverCodexMarketplacePlugins as t, steerCodexConversationTurn as u };