@openclaw/codex 2026.7.2-beta.5 → 2026.8.1-beta.2

package/dist/{shared-client-BVKE40c-.js → shared-client-kIBbGjk4.js}

@@ -1,22 +1,24 @@
 import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
-import { d as codexAppServerStartOptionsKey, h as resolveCodexComputerUseConfig, m as resolveCodexAppServerStartOptionsForAgent, o as isCodexAppServerNativeAuthProfile, p as resolveCodexAppServerRuntimeOptions, x as resolveCodexAppServerUserHomeDir } from "./session-binding-DlVQ-Pxs.js";
-import { n as resolveCodexAppServerSpawnEnv, t as createStdioTransport } from "./transport-stdio-DXgGZ7Ib.js";
+import { A as resolveCodexAppServerUserHomeDir, _ as resolveCodexAppServerStartOptionsForAgent, g as resolveCodexAppServerRuntimeOptions, o as isCodexAppServerNativeAuthProfile, p as codexAppServerStartOptionsKey, v as resolveCodexComputerUseConfig } from "./session-binding-DPxIvMgE.js";
+import { n as resolveCodexAppServerSpawnEnv, t as createStdioTransport } from "./transport-stdio-DIImwDVS.js";
 import { createRequire } from "node:module";
+import { isRecord, normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
 import fs, { access } from "node:fs/promises";
 import path from "node:path";
+import { createDeferred } from "openclaw/plugin-sdk/extension-shared";
 import { addTimerTimeoutGraceMs, resolveTimerTimeoutMs } from "openclaw/plugin-sdk/number-runtime";
-import { AgentHarnessPreflightError, OPENCLAW_VERSION, embeddedAgentLog } from "openclaw/plugin-sdk/agent-harness-runtime";
+import { AgentHarnessPreflightError, OPENCLAW_VERSION, embeddedAgentLog, formatErrorMessage } from "openclaw/plugin-sdk/agent-harness-runtime";
 import { createHash, randomUUID } from "node:crypto";
-import { ensureAuthProfileStore, findPersistedAuthProfileCredential, loadAuthProfileStoreForSecretsRuntime, refreshOAuthCredentialForRuntime, resolveApiKeyForProfile, resolveAuthProfileOrder, resolveDefaultAgentDir, resolvePersistedAuthProfileOwnerAgentDir, resolveProviderIdForAuth } from "openclaw/plugin-sdk/agent-runtime";
-import { createDeferred } from "openclaw/plugin-sdk/extension-shared";
 import fsSync, { constants, existsSync, readFileSync, realpathSync } from "node:fs";
 import os from "node:os";
 import { isDeepStrictEqual } from "node:util";
+import { ensureAuthProfileStore, findPersistedAuthProfileCredential, loadAuthProfileStoreForSecretsRuntime, refreshOAuthCredentialForRuntime, resolveApiKeyForProfile, resolveAuthProfileOrder, resolveDefaultAgentDir, resolvePersistedAuthProfileOwnerAgentDir, resolveProviderIdForAuth } from "openclaw/plugin-sdk/agent-runtime";
 import { hasUsableOAuthCredential } from "openclaw/plugin-sdk/provider-auth";
+import { readSecretFile } from "openclaw/plugin-sdk/secret-file";
 import { runExec } from "openclaw/plugin-sdk/process-runtime";
 import { createInterface } from "node:readline";
+import { coerceErrorMessage, toStringifiedError } from "openclaw/plugin-sdk/error-runtime";
 import { sliceUtf16Safe, truncateUtf16Safe } from "openclaw/plugin-sdk/text-utility-runtime";
-import { parse } from "semver";
 import { EventEmitter } from "node:events";
 import net from "node:net";
 import { PassThrough, Writable } from "node:stream";
@@ -25,109 +27,18 @@ import WebSocket from "ws";
 import { fileURLToPath } from "node:url";
 import { expectDefined } from "openclaw/plugin-sdk/expect-runtime";
 import { withTimeout } from "openclaw/plugin-sdk/security-runtime";
-//#region extensions/codex/src/app-server/attempt-timeouts.ts
-/**
-* Timeout defaults and normalizers for Codex app-server startup and turn
-* liveness watches.
-*/
-/** Minimum startup timeout accepted by the Codex app-server harness. */
-const CODEX_APP_SERVER_STARTUP_TIMEOUT_FLOOR_MS = 100;
-/** Default idle timeout while waiting for app-server turn completion. */
-const CODEX_TURN_COMPLETION_IDLE_TIMEOUT_MS = 6e4;
-/** Short guard after apparent assistant completion. */
-const CODEX_TURN_ASSISTANT_COMPLETION_IDLE_TIMEOUT_MS = 1e4;
-const CODEX_POST_TOOL_RAW_ASSISTANT_COMPLETION_IDLE_TIMEOUT_MS = 5 * 6e4;
-/** Guard after reasoning/commentary progress when no tool handoff occurred. */
-const CODEX_POST_REASONING_REPLY_IDLE_TIMEOUT_MS = 5 * 6e4;
-/** Long terminal idle watch for app-server turns that never send completion. */
-const CODEX_TURN_TERMINAL_IDLE_TIMEOUT_MS = 30 * 6e4;
-var CodexAppServerStartupError = class extends Error {
-	constructor(reason, message = reason === "timed_out" ? "codex app-server startup timed out" : "codex app-server startup aborted") {
-		super(message);
-		this.reason = reason;
-		this.code = "CODEX_APP_SERVER_STARTUP_CANCELLED";
-		this.name = "CodexAppServerStartupError";
-	}
-};
-function isCodexAppServerStartupError(error, reason) {
-	return error instanceof Error && "code" in error && error.code === "CODEX_APP_SERVER_STARTUP_CANCELLED" && "reason" in error && (error.reason === "aborted" || error.reason === "timed_out") && (reason === void 0 || error.reason === reason);
-}
-function resolvePositiveIntegerTimeoutMs(value, fallbackMs) {
-	return resolveTimerTimeoutMs(value, resolveTimerTimeoutMs(fallbackMs, 1));
-}
-/** Runs startup work with abort and timeout handling plus optional cleanup. */
-async function withCodexStartupTimeout(params) {
-	if (params.signal.aborted) throw new CodexAppServerStartupError("aborted");
-	let timeout;
-	let abortCleanup;
-	let timeoutError;
-	let timeoutCleanup;
-	try {
-		return await Promise.race([params.operation(), new Promise((_, reject) => {
-			const rejectOnce = (error) => {
-				if (timeout) {
-					clearTimeout(timeout);
-					timeout = void 0;
-				}
-				reject(error);
-			};
-			timeout = setTimeout(() => {
-				timeoutError = new CodexAppServerStartupError("timed_out");
-				timeoutCleanup = Promise.resolve(params.onTimeout?.()).then(() => void 0, () => void 0);
-				timeoutCleanup.finally(() => {
-					rejectOnce(timeoutError);
-				});
-			}, params.timeoutMs);
-			const abortListener = () => rejectOnce(new CodexAppServerStartupError("aborted"));
-			params.signal.addEventListener("abort", abortListener, { once: true });
-			abortCleanup = () => params.signal.removeEventListener("abort", abortListener);
-		})]);
-	} catch (error) {
-		if (timeoutError) {
-			await timeoutCleanup;
-			throw timeoutError;
-		}
-		throw error;
-	} finally {
-		if (timeout) clearTimeout(timeout);
-		abortCleanup?.();
-	}
-}
-/** Resolves startup timeout while honoring the configured floor. */
-function resolveCodexStartupTimeoutMs(params) {
-	const timeoutFloorMs = resolvePositiveIntegerTimeoutMs(params.timeoutFloorMs, CODEX_APP_SERVER_STARTUP_TIMEOUT_FLOOR_MS);
-	const timeoutMs = resolvePositiveIntegerTimeoutMs(params.timeoutMs, timeoutFloorMs);
-	return Math.max(timeoutFloorMs, timeoutMs);
-}
-/** Resolves the completion-idle timeout for an active turn. */
-function resolveCodexTurnCompletionIdleTimeoutMs(value) {
-	return resolvePositiveIntegerTimeoutMs(value, CODEX_TURN_COMPLETION_IDLE_TIMEOUT_MS);
-}
-/** Resolves the short assistant-completion release timeout. */
-function resolveCodexTurnAssistantCompletionIdleTimeoutMs(value) {
-	return resolvePositiveIntegerTimeoutMs(value, CODEX_TURN_ASSISTANT_COMPLETION_IDLE_TIMEOUT_MS);
-}
-/** Resolves the conservative post-tool raw assistant guard timeout. */
-function resolveCodexPostToolRawAssistantCompletionIdleTimeoutMs(value, fallbackMs) {
-	return resolvePositiveIntegerTimeoutMs(value, Math.max(resolvePositiveIntegerTimeoutMs(void 0, fallbackMs), CODEX_POST_TOOL_RAW_ASSISTANT_COMPLETION_IDLE_TIMEOUT_MS));
-}
-/** Resolves the long terminal turn idle timeout. */
-function resolveCodexTurnTerminalIdleTimeoutMs(value, runTimeoutOverrideMs) {
-	const explicitRunBudgetMs = resolvePositiveIntegerTimeoutMs(runTimeoutOverrideMs, CODEX_TURN_TERMINAL_IDLE_TIMEOUT_MS);
-	return resolvePositiveIntegerTimeoutMs(value, Math.max(CODEX_TURN_TERMINAL_IDLE_TIMEOUT_MS, explicitRunBudgetMs));
-}
-/** Adds gateway grace time to a caller timeout without overflowing invalid values. */
-function resolveCodexGatewayTimeoutWithGraceMs(timeoutMs, graceMs = 1e4) {
-	const timeout = resolvePositiveIntegerTimeoutMs(timeoutMs, 1);
-	return addTimerTimeoutGraceMs(timeout, resolveTimerTimeoutMs(graceMs, 0, 0)) ?? timeout;
-}
-//#endregion
 //#region extensions/codex/src/app-server/auth-start-options.ts
 const CODEX_APP_SERVER_HOME_DIRNAME = "codex-home";
 const CODEX_EPHEMERAL_AUTH_STORE_OVERRIDE = "cli_auth_credentials_store=\"ephemeral\"";
 function resolveCodexAppServerHomeDir(agentDir) {
 	return path.join(path.resolve(agentDir), CODEX_APP_SERVER_HOME_DIRNAME);
 }
+/** Resolves the local CODEX_HOME used when starting one app-server connection. */
+function resolveCodexAppServerLocalHomeDir(startOptions, agentDir, env = process.env) {
+	const configured = startOptions.env?.CODEX_HOME;
+	if (configured?.trim()) return configured;
+	return startOptions.homeScope === "user" ? resolveCodexAppServerUserHomeDir(env) : resolveCodexAppServerHomeDir(agentDir);
+}
 /** Forces OpenClaw-owned Codex auth to remain process-local. */
 function withEphemeralCodexAuthStore(params) {
 	const { startOptions } = params;
@@ -408,8 +319,8 @@ function flattenCodexDynamicToolFunctions(tools) {
 }
 const CODEX_INTERACTIVE_THREAD_SOURCE_KINDS = ["cli", "vscode"];
 const CODEX_INTERACTIVE_CUSTOM_THREAD_SOURCES = ["atlas", "chatgpt"];
-function isJsonObject$1(value) {
-	return Boolean(value && typeof value === "object" && !Array.isArray(value));
+function isJsonObject(value) {
+	return isRecord(value);
 }
 function isRpcResponse(message) {
 	return "id" in message && !("method" in message);
@@ -417,10 +328,7 @@ function isRpcResponse(message) {
 //#endregion
 //#region extensions/codex/src/app-server/auth-bridge.ts
 const CODEX_APP_SERVER_AUTH_PROVIDER = "openai";
-const OPENAI_CODEX_APP_SERVER_AUTH_PROVIDER = "openai-codex";
-const LEGACY_CODEX_APP_SERVER_AUTH_PROVIDER = "codex-cli";
-const CODEX_APP_SERVER_EXTERNAL_CLI_PROVIDER_IDS = [CODEX_APP_SERVER_AUTH_PROVIDER, LEGACY_CODEX_APP_SERVER_AUTH_PROVIDER];
-const OPENAI_PROVIDER = "openai";
+const CODEX_APP_SERVER_EXTERNAL_CLI_PROVIDER_IDS = [CODEX_APP_SERVER_AUTH_PROVIDER];
 const OPENAI_CODEX_DEFAULT_PROFILE_ID = "openai:default";
 const CODEX_HOME_ENV_VAR = "CODEX_HOME";
 const HOME_ENV_VAR = "HOME";
@@ -439,25 +347,41 @@ const CODEX_HOME_DIRNAME = ".codex";
 const scopedOAuthRefreshQueues = /* @__PURE__ */ new WeakMap();
 async function bridgeCodexAppServerStartOptions(params) {
 	if (params.startOptions.transport !== "stdio") return params.startOptions;
-	const scopedStartOptions = await withCodexHomeEnvironment(withEphemeralCodexAuthStore(params), params.agentDir, params.pluginConfig);
-	if (params.preparedAuth) return withClearedEnvironmentVariables(scopedStartOptions, CODEX_APP_SERVER_PREPARED_AUTH_ENV_VARS);
-	if (params.authProfileId === null) return scopedStartOptions;
+	const scopeStartOptions = () => withCodexHomeEnvironment(withEphemeralCodexAuthStore(params), params.agentDir, params.pluginConfig);
+	if (params.preparedAuth) return withClearedEnvironmentVariables(await scopeStartOptions(), CODEX_APP_SERVER_PREPARED_AUTH_ENV_VARS);
+	if (params.authProfileId === null) return scopeStartOptions();
 	const store = resolveCodexAppServerAuthProfileStore({
 		agentDir: params.agentDir,
 		authProfileId: params.authProfileId,
 		authProfileStore: params.authProfileStore,
 		config: params.config
 	});
-	return shouldClearOpenAiApiKeyForCodexAuthProfile({
+	const authProfileId = resolveCodexAppServerAuthProfileId({
+		authProfileId: params.authProfileId,
 		store,
-		authProfileId: resolveCodexAppServerAuthProfileId({
-			authProfileId: params.authProfileId,
-			store,
-			config: params.config
-		}),
 		config: params.config
+	});
+	if (!authProfileId) assertNoUnimportedAgentCodexAuthFile(params);
+	const scopedStartOptions = await scopeStartOptions();
+	return shouldClearOpenAiApiKeyForCodexAuthProfile({
+		store,
+		authProfileId
 	}) ? withClearedEnvironmentVariables(scopedStartOptions, CODEX_APP_SERVER_API_KEY_ENV_VARS) : scopedStartOptions;
 }
+function assertNoUnimportedAgentCodexAuthFile(params) {
+	if (params.authRequirement === "api-key" && resolveCodexAppServerFallbackApiKeyCacheKey({ startOptions: params.startOptions })) return;
+	const message = resolveUnimportedAgentCodexAuthMessage(params);
+	if (message) throw new AgentHarnessPreflightError(message);
+}
+function resolveUnimportedAgentCodexAuthMessage(params) {
+	const managedCodexCli = params.startOptions.commandSource === "managed" || params.startOptions.commandSource === "resolved-managed";
+	if (params.startOptions.transport !== "stdio" || !managedCodexCli || params.startOptions.homeScope === "user") return;
+	const codexHome = resolveCodexAppServerHomeDir(params.agentDir);
+	const authPath = path.join(codexHome, CODEX_AUTH_JSON_FILENAME);
+	if (!fsSync.existsSync(authPath)) return;
+	const targetAgentId = params.agentId?.trim() || "<agent-id>";
+	return `A Codex auth file exists at ${authPath}, but agent-scoped Codex runs use OpenClaw's auth store and do not read that file. Preview only that credential import with \`openclaw migrate plan codex --from <codex-home> --agent ${targetAgentId} --include-secrets --item auth:openai\`, then run \`openclaw migrate apply codex --from <codex-home> --agent ${targetAgentId} --include-secrets --item auth:openai --yes\`. If the plan finds no credentials, remove the stale auth file.`;
+}
 function resolveCodexAppServerAuthProfileId(params) {
 	const requested = params.authProfileId?.trim();
 	if (requested) return requested;
@@ -512,7 +436,7 @@ async function resolveCodexAppServerPreparedAuthProfileSnapshot(params) {
 	});
 	if (!profileId) return;
 	const credential = store.profiles[profileId];
-	if (!credential || !isCodexAppServerAuthProfileCredential(credential, params.config)) return;
+	if (!credential || !isCodexAppServerAuthProfileCredential(credential)) return;
 	const loginParams = await resolveCodexAppServerAuthProfileLoginParamsInternal({
 		agentDir,
 		authProfileId: profileId,
@@ -522,14 +446,18 @@ async function resolveCodexAppServerPreparedAuthProfileSnapshot(params) {
 	if (!loginParams) return;
 	const accountId = loginParams.type === "chatgptAuthTokens" ? loginParams.chatgptAccountId : resolveChatgptAccountId(profileId, credential);
 	const stableChatgptAccountId = resolveStableChatgptAccountId(credential);
+	const secretFreeCacheKey = credential.type === "api_key" && loginParams.type === "apiKey" ? `${accountId}:${fingerprintApiKeyAuthProfileCacheKey(loginParams.apiKey)}` : loginParams.type === "chatgptAuthTokens" && (credential.type === "token" || !stableChatgptAccountId) ? `${accountId}:${fingerprintTokenAuthProfileCacheKey(loginParams.accessToken)}` : accountId;
+	const chatgptAccountId = resolveExplicitChatgptAccountId(credential);
 	return {
 		loginParams,
-		secretFreeCacheKey: credential.type === "api_key" && loginParams.type === "apiKey" ? `${accountId}:${fingerprintApiKeyAuthProfileCacheKey(loginParams.apiKey)}` : loginParams.type === "chatgptAuthTokens" && (credential.type === "token" || !stableChatgptAccountId) ? `${accountId}:${fingerprintTokenAuthProfileCacheKey(loginParams.accessToken)}` : accountId
+		secretFreeCacheKey,
+		...chatgptAccountId ? { chatgptAccountId } : {}
 	};
 }
 /** Maps one prepared route to one mutually exclusive app-server auth handoff. */
 async function resolveCodexAppServerPreparedAuthHandoff(params) {
 	const usesNativeHome = params.homeScope === "user";
+	if (params.requirePreparedAuth && usesNativeHome) throw createCodexAppServerAuthError("Codex remote-exec cloud placement requires prepared OpenAI auth. Configure an OpenAI API-key, OAuth, or token profile and use appServer.homeScope=\"agent\"; ambient credentials and native Codex auth are not allowed.");
 	if (params.authRequirement === "api-key" && !usesNativeHome) {
 		const apiKey = params.resolvedApiKey?.trim();
 		if (!apiKey) throw new Error("Prepared Codex API-key route is missing its resolved API key.");
@@ -548,18 +476,18 @@ async function resolveCodexAppServerPreparedAuthHandoff(params) {
 		agentDir: params.agentDir,
 		config: params.config
 	});
-	if (usesNativeHome || params.authRequirement !== "subscription") return {
+	if (usesNativeHome || params.authRequirement !== "subscription" && !params.requirePreparedAuth) return {
 		authProfileId,
 		nativeAuthProfile
 	};
-	if (!authProfileId || !nativeAuthProfile) throw createCodexAppServerAuthError(params.subscriptionProfileRequiredError);
+	if (!authProfileId || params.authRequirement === "subscription" && !nativeAuthProfile) throw createCodexAppServerAuthError(params.requirePreparedAuth ? "Codex remote-exec cloud placement requires prepared OpenAI auth. Configure an OpenAI API-key, OAuth, or token profile; ambient CODEX_API_KEY, OPENAI_API_KEY, and native Codex auth are not allowed." : params.subscriptionProfileRequiredError);
 	const snapshot = await resolveCodexAppServerPreparedAuthProfileSnapshot({
 		authProfileId,
 		authProfileStore: params.authProfileStore,
 		agentDir: params.agentDir,
 		config: params.config
 	});
-	if (!snapshot) throw createCodexAppServerAuthError(params.subscriptionProfileUnusableError);
+	if (!snapshot) throw createCodexAppServerAuthError(params.requirePreparedAuth ? "Codex remote-exec cloud placement could not prepare the selected OpenAI auth profile. Repair or replace the profile, then retry." : params.subscriptionProfileUnusableError);
 	return {
 		authProfileId,
 		nativeAuthProfile,
@@ -586,7 +514,7 @@ async function resolveCodexAppServerAuthAccountCacheKey(params) {
 	});
 	if (!profileId) return;
 	const credential = store.profiles[profileId];
-	if (!credential || !isCodexAppServerAuthProfileCredential(credential, params.config)) return;
+	if (!credential || !isCodexAppServerAuthProfileCredential(credential)) return;
 	if (credential.type === "api_key") {
 		const apiKey = (await resolveApiKeyForProfile({
 			store,
@@ -648,7 +576,7 @@ function fingerprintCodexCliAuthFileApiKeyCacheKey(apiKey) {
 	return `CODEX_AUTH_JSON:sha256:${hash.digest("hex")}`;
 }
 async function withCodexHomeEnvironment(startOptions, agentDir, pluginConfig) {
-	const codexHome = startOptions.env?.[CODEX_HOME_ENV_VAR]?.trim() ? startOptions.env[CODEX_HOME_ENV_VAR] : startOptions.homeScope === "user" ? resolveCodexAppServerUserHomeDir(process.env) : resolveCodexAppServerHomeDir(agentDir);
+	const codexHome = resolveCodexAppServerLocalHomeDir(startOptions, agentDir);
 	const nativeHome = startOptions.env?.[HOME_ENV_VAR]?.trim() ? startOptions.env[HOME_ENV_VAR] : void 0;
 	await fs.mkdir(codexHome, { recursive: true });
 	const computerUseConfig = resolveCodexComputerUseConfig({ pluginConfig });
@@ -662,7 +590,10 @@ async function withCodexHomeEnvironment(startOptions, agentDir, pluginConfig) {
 			appServerCommand: startOptions.command
 		});
 	} catch (error) {
-		throw new AgentHarnessPreflightError("Codex Computer Use client provisioning failed.", { cause: error });
+		throw new AgentHarnessPreflightError("Codex Computer Use client provisioning failed.", {
+			cause: error,
+			scope: "harness"
+		});
 	}
 	if (nativeHome) await fs.mkdir(nativeHome, { recursive: true });
 	const nextStartOptions = {
@@ -697,10 +628,7 @@ async function applyCodexAppServerAuthProfile(params) {
 		return;
 	}
 	if (params.authProfileId === null) {
-		if (params.authRequirement === "subscription") {
-			const response = await params.client.request("account/read", { refreshToken: false });
-			if (!isJsonObject$1(response.account) || response.account.type !== "chatgpt") throw createCodexAppServerAuthError("Codex subscription auth profile could not produce login credentials.");
-		}
+		await assertNativeCodexAccountMatchesRoute(params.client, params.authRequirement);
 		return;
 	}
 	let loginParams;
@@ -730,6 +658,23 @@ async function applyCodexAppServerAuthProfile(params) {
 	}
 	await params.client.request("account/login/start", loginParams);
 }
+/**
+* Native-home connections are verified, never logged into. Both directions of the
+* check protect the same billing boundary: a subscription route cannot run without
+* ChatGPT tokens, and a Platform route must not silently spend the operator's
+* ChatGPT plan. An absent account is left alone because the native home may serve a
+* custom model provider that reports no OpenAI account at all.
+*/
+async function assertNativeCodexAccountMatchesRoute(client, authRequirement) {
+	if (!authRequirement) return;
+	const response = await client.request("account/read", { refreshToken: false });
+	const accountType = isJsonObject(response.account) ? response.account.type : void 0;
+	if (authRequirement === "subscription") {
+		if (accountType !== "chatgpt") throw createCodexAppServerAuthError("Codex subscription auth profile could not produce login credentials.");
+		return;
+	}
+	if (accountType === "chatgpt") throw createCodexAppServerAuthError("Codex Platform route requires an API-key account, but the native Codex home is signed in with a ChatGPT subscription. Sign that home in with `codex login --with-api-key`, or set appServer.homeScope=\"agent\" so OpenClaw can inject its own key.");
+}
 function createCodexAppServerAuthError(message, cause) {
 	const error = cause === void 0 ? new Error(message) : new Error(message, { cause });
 	return Object.assign(error, { status: 401 });
@@ -744,7 +689,7 @@ async function resolveCodexAppServerAuthProfileLoginParams(params) {
 	});
 	const profile = profileId ? store.profiles[profileId] : void 0;
 	if (profileId && !profile) throw new CodexAppServerAuthProfileUnavailableError(`Codex app-server auth profile "${profileId}" was not found.`);
-	if (profileId && profile && !isCodexAppServerAuthProfileCredential(profile, params.config)) throw new CodexAppServerAuthProfileUnavailableError(`Codex app-server auth profile "${profileId}" must be OpenAI Codex auth or an OpenAI API-key backup.`);
+	if (profileId && profile && !isCodexAppServerAuthProfileCredential(profile)) throw new CodexAppServerAuthProfileUnavailableError(`Codex app-server auth profile "${profileId}" must use the canonical OpenAI auth provider; run "openclaw doctor --fix" to migrate legacy provider IDs.`);
 	return await resolveCodexAppServerAuthProfileLoginParamsInternal({
 		...params,
 		authProfileStore: store
@@ -777,7 +722,7 @@ async function resolveCodexAppServerAuthProfileLoginParamsInternal(params) {
 	if (!profileId) return;
 	const credential = store.profiles[profileId];
 	if (!credential) throw new Error(`Codex app-server auth profile "${profileId}" was not found.`);
-	if (!isCodexAppServerAuthProfileCredential(credential, params.config)) throw new Error(`Codex app-server auth profile "${profileId}" must be OpenAI Codex auth or an OpenAI API-key backup.`);
+	if (!isCodexAppServerAuthProfileCredential(credential)) throw new Error(`Codex app-server auth profile "${profileId}" must use the canonical OpenAI auth provider; run "openclaw doctor --fix" to migrate legacy provider IDs.`);
 	const loginParams = await resolveLoginParamsForCredential(profileId, credential, {
 		agentDir: params.agentDir,
 		store,
@@ -823,7 +768,7 @@ function parseCodexCliAuthFileApiKey(raw) {
 }
 async function readCodexCliAuthFileApiKey(env) {
 	try {
-		return parseCodexCliAuthFileApiKey(await fs.readFile(resolveCodexCliAuthFilePath(env), "utf8"));
+		return parseCodexCliAuthFileApiKey(await readSecretFile(resolveCodexCliAuthFilePath(env), "Codex CLI auth file"));
 	} catch {
 		return;
 	}
@@ -888,9 +833,9 @@ async function resolveOAuthCredentialForCodexAppServer(profileId, credential, pa
 		authProfileId: profileId,
 		config: params.config
 	});
-	const persistedOAuthCredential = !useScopedCredential && persistedCredential?.type === "oauth" && isCodexAppServerAuthProvider(persistedCredential.provider, params.config) ? persistedCredential : void 0;
+	const persistedOAuthCredential = !useScopedCredential && persistedCredential?.type === "oauth" && isCodexAppServerAuthProvider(persistedCredential.provider) ? persistedCredential : void 0;
 	const ownerCredential = store.profiles[profileId];
-	const overlaidOAuthCredential = ownerCredential?.type === "oauth" && isCodexAppServerAuthProvider(ownerCredential.provider, params.config) ? ownerCredential : void 0;
+	const overlaidOAuthCredential = ownerCredential?.type === "oauth" && isCodexAppServerAuthProvider(ownerCredential.provider) ? ownerCredential : void 0;
 	if (useScopedCredential && overlaidOAuthCredential) return await resolveScopedOAuthCredential({
 		store,
 		profileId,
@@ -910,10 +855,10 @@ async function resolveOAuthCredentialForCodexAppServer(profileId, credential, pa
 		forceRefresh: params.forceRefresh && Boolean(persistedOAuthCredential)
 	});
 	const refreshed = useScopedCredential ? void 0 : loadAuthProfileStoreForSecretsRuntime(ownerAgentDir).profiles[profileId];
-	const refreshedOAuthCredential = refreshed?.type === "oauth" && isCodexAppServerAuthProvider(refreshed.provider, params.config) ? refreshed : void 0;
+	const refreshedOAuthCredential = refreshed?.type === "oauth" && isCodexAppServerAuthProvider(refreshed.provider) ? refreshed : void 0;
 	if (refreshedOAuthCredential && isDeepStrictEqual(params.store.profiles[profileId], credential)) params.store.profiles[profileId] = refreshedOAuthCredential;
 	const storedCredential = store.profiles[profileId];
-	const candidate = refreshedOAuthCredential ? refreshedOAuthCredential : storedCredential?.type === "oauth" && isCodexAppServerAuthProvider(storedCredential.provider, params.config) ? storedCredential : credential;
+	const candidate = refreshedOAuthCredential ? refreshedOAuthCredential : storedCredential?.type === "oauth" && isCodexAppServerAuthProvider(storedCredential.provider) ? storedCredential : credential;
 	return resolved?.apiKey ? {
 		...candidate,
 		access: resolved.apiKey
@@ -957,22 +902,18 @@ async function resolveScopedOAuthCredential(params) {
 		if (storeRefreshes.get(params.profileId) === refresh) storeRefreshes.delete(params.profileId);
 	}
 }
-function isCodexAppServerAuthProvider(provider, config) {
-	const resolvedProvider = resolveProviderIdForAuth(provider, { config });
-	return resolvedProvider === CODEX_APP_SERVER_AUTH_PROVIDER || resolvedProvider === OPENAI_CODEX_APP_SERVER_AUTH_PROVIDER || resolvedProvider === LEGACY_CODEX_APP_SERVER_AUTH_PROVIDER;
-}
-function isOpenAIApiKeyBackupCredential(credential, config) {
-	return credential.type === "api_key" && resolveProviderIdForAuth(credential.provider, { config }) === OPENAI_PROVIDER;
+function isCodexAppServerAuthProvider(provider) {
+	return provider.trim().toLowerCase() === CODEX_APP_SERVER_AUTH_PROVIDER;
 }
-function isCodexAppServerAuthProfileCredential(credential, config) {
-	return isCodexAppServerAuthProvider(credential.provider, config) || isOpenAIApiKeyBackupCredential(credential, config);
+function isCodexAppServerAuthProfileCredential(credential) {
+	return isCodexAppServerAuthProvider(credential.provider);
 }
 function shouldClearOpenAiApiKeyForCodexAuthProfile(params) {
 	const profileId = params.authProfileId?.trim();
-	return isCodexSubscriptionCredential(profileId ? params.store.profiles[profileId] : params.store.profiles[OPENAI_CODEX_DEFAULT_PROFILE_ID], params.config);
+	return isCodexSubscriptionCredential(profileId ? params.store.profiles[profileId] : params.store.profiles[OPENAI_CODEX_DEFAULT_PROFILE_ID]);
 }
-function isCodexSubscriptionCredential(credential, config) {
-	if (!credential || !isCodexAppServerAuthProvider(credential.provider, config)) return false;
+function isCodexSubscriptionCredential(credential) {
+	if (!credential || !isCodexAppServerAuthProvider(credential.provider)) return false;
 	return credential.type === "oauth" || credential.type === "token";
 }
 function withClearedEnvironmentVariables(startOptions, envVars) {
@@ -1013,11 +954,13 @@ function resolveChatgptAccountId(profileId, credential) {
 	return resolveStableChatgptAccountId(credential) ?? profileId;
 }
 function resolveStableChatgptAccountId(credential) {
+	return resolveExplicitChatgptAccountId(credential) ?? (credential.email?.trim() || void 0);
+}
+function resolveExplicitChatgptAccountId(credential) {
 	if ("accountId" in credential && typeof credential.accountId === "string") {
 		const accountId = credential.accountId.trim();
 		if (accountId) return accountId;
 	}
-	return credential.email?.trim() || void 0;
 }
 //#endregion
 //#region extensions/codex/src/app-server/rate-limit-cache.ts
@@ -1042,7 +985,7 @@ function rememberCodexRateLimitsRead(client, value, nowMs = Date.now()) {
 }
 /** Merges a sparse rolling notification into one physical client's latest read response. */
 function mergeCodexRateLimitsUpdate(client, value, nowMs = Date.now()) {
-	const update = isJsonObject$1(value) && isJsonObject$1(value.rateLimits) ? value.rateLimits : void 0;
+	const update = isJsonObject(value) && isJsonObject(value.rateLimits) ? value.rateLimits : void 0;
 	if (!update) return;
 	const currentState = rateLimitsByClient.get(client);
 	const current = currentState?.value;
@@ -1069,13 +1012,13 @@ function readRecentCodexRateLimits(client, options) {
 	return maxAgeMs >= 0 && nowMs - state.updatedAtMs > maxAgeMs ? void 0 : state.value;
 }
 function mergeRateLimitUpdate(current, update) {
-	const currentEnvelope = isJsonObject$1(current) ? current : void 0;
-	const currentPrimary = currentEnvelope && isJsonObject$1(currentEnvelope.rateLimits) ? currentEnvelope.rateLimits : void 0;
-	const currentByLimitId = currentEnvelope && isJsonObject$1(currentEnvelope.rateLimitsByLimitId) ? currentEnvelope.rateLimitsByLimitId : void 0;
+	const currentEnvelope = isJsonObject(current) ? current : void 0;
+	const currentPrimary = currentEnvelope && isJsonObject(currentEnvelope.rateLimits) ? currentEnvelope.rateLimits : void 0;
+	const currentByLimitId = currentEnvelope && isJsonObject(currentEnvelope.rateLimitsByLimitId) ? currentEnvelope.rateLimitsByLimitId : void 0;
 	const limitId = readLimitId(update);
 	const currentPrimaryLimitId = currentPrimary ? readLimitId(currentPrimary) : void 0;
-	const currentForLimit = (currentByLimitId && isJsonObject$1(currentByLimitId[limitId]) ? currentByLimitId[limitId] : void 0) ?? (currentPrimaryLimitId === limitId ? currentPrimary : void 0);
-	const merged = mergeSparseSnapshot(isJsonObject$1(currentForLimit) ? currentForLimit : void 0, currentPrimary, update, limitId);
+	const currentForLimit = (currentByLimitId && isJsonObject(currentByLimitId[limitId]) ? currentByLimitId[limitId] : void 0) ?? (currentPrimaryLimitId === limitId ? currentPrimary : void 0);
+	const merged = mergeSparseSnapshot(isJsonObject(currentForLimit) ? currentForLimit : void 0, currentPrimary, update, limitId);
 	const nextPrimary = !currentPrimary || currentPrimaryLimitId === limitId ? merged : currentPrimary;
 	let nextByLimitId;
 	if (currentByLimitId) nextByLimitId = {
@@ -1093,11 +1036,11 @@ function mergeRateLimitUpdate(current, update) {
 	};
 }
 function readRateLimitIds(value) {
-	if (!isJsonObject$1(value)) return [];
+	if (!isJsonObject(value)) return [];
 	const ids = /* @__PURE__ */ new Set();
-	if (isJsonObject$1(value.rateLimits)) ids.add(readLimitId(value.rateLimits));
-	if (isJsonObject$1(value.rateLimitsByLimitId)) for (const [key, snapshot] of Object.entries(value.rateLimitsByLimitId)) {
-		const snapshotLimitId = isJsonObject$1(snapshot) && typeof snapshot.limitId === "string" ? snapshot.limitId.trim() : "";
+	if (isJsonObject(value.rateLimits)) ids.add(readLimitId(value.rateLimits));
+	if (isJsonObject(value.rateLimitsByLimitId)) for (const [key, snapshot] of Object.entries(value.rateLimitsByLimitId)) {
+		const snapshotLimitId = isJsonObject(snapshot) && typeof snapshot.limitId === "string" ? snapshot.limitId.trim() : "";
 		ids.add(snapshotLimitId || key);
 	}
 	return [...ids];
@@ -1120,16 +1063,45 @@ function readLimitId(snapshot) {
 //#endregion
 //#region extensions/codex/src/app-server/client-runtime.ts
 /** Client-scoped Codex auth and account observers. */
+/** Match Codex's native grace window without retaining inactive conversations indefinitely. */
+const CODEX_APP_SERVER_LIVE_THREAD_IDLE_TIMEOUT_MS = 30 * 6e4;
+/** Native-child parents are active ownership, so only otherwise-idle threads count against this cap. */
+const CODEX_APP_SERVER_LIVE_THREAD_MAX_IDLE = 64;
 const configuredClients = /* @__PURE__ */ new WeakMap();
+const physicalThreadReleases = /* @__PURE__ */ new WeakMap();
+const claimedThreadReleaseTokens = /* @__PURE__ */ new WeakMap();
+/** Only an initialized, still-open physical client can own retained native subscriptions. */
+function isCodexAppServerClientRuntimeLive(client) {
+	const runtime = configuredClients.get(client);
+	return runtime !== void 0 && !runtime.closed;
+}
 /** Installs one auth-refresh handler and one rate-limit observer per physical client. */
 function ensureCodexAppServerClientRuntime(client, context) {
 	const existing = configuredClients.get(client);
 	if (existing) {
+		if (existing.closed) return;
 		existing.context = context;
 		return;
 	}
-	const runtime = { context };
+	const runtime = {
+		context,
+		closed: false,
+		retainedThreads: /* @__PURE__ */ new Map(),
+		claimedThreads: /* @__PURE__ */ new Map(),
+		releasingThreads: /* @__PURE__ */ new Map(),
+		protectedThreads: /* @__PURE__ */ new Map()
+	};
 	configuredClients.set(client, runtime);
+	client.addCloseHandler(() => {
+		runtime.closed = true;
+		if (runtime.evictionTimer) {
+			clearTimeout(runtime.evictionTimer);
+			runtime.evictionTimer = void 0;
+		}
+		runtime.retainedThreads.clear();
+		runtime.claimedThreads.clear();
+		runtime.protectedThreads.clear();
+	});
 	client.addRequestHandler(async (request) => {
 		if (request.method !== "account/chatgptAuthTokens/refresh") return;
 		if (runtime.context.authMode === "prepared-api-key") throw new Error("ChatGPT token refresh is unavailable for prepared Codex API-key auth.");
@@ -1141,15 +1113,289 @@ function ensureCodexAppServerClientRuntime(client, context) {
 		});
 	});
 	client.addNotificationHandler((notification) => {
-		if (notification.method === "account/rateLimits/updated") mergeCodexRateLimitsUpdate(client, notification.params);
+		if (notification.method === "account/rateLimits/updated") {
+			mergeCodexRateLimitsUpdate(client, notification.params);
+			return;
+		}
+		if (notification.method === "thread/archived" || notification.method === "thread/deleted" || notification.method === "thread/closed") {
+			const threadId = notification.params?.threadId;
+			if (typeof threadId === "string") {
+				const releasing = runtime.releasingThreads.get(threadId);
+				if (releasing) releasing.invalidated = true;
+				runtime.retainedThreads.delete(threadId);
+				runtime.claimedThreads.delete(threadId);
+				scheduleRetainedThreadEviction(client, runtime);
+			}
+		}
+	});
+}
+function scheduleRetainedThreadEviction(client, runtime) {
+	if (runtime.evictionTimer) {
+		clearTimeout(runtime.evictionTimer);
+		runtime.evictionTimer = void 0;
+	}
+	if (runtime.closed) return;
+	let expiresAt = Number.POSITIVE_INFINITY;
+	for (const [threadId, thread] of runtime.retainedThreads) if (!runtime.protectedThreads.has(threadId)) expiresAt = Math.min(expiresAt, thread.expiresAt);
+	if (!Number.isFinite(expiresAt)) return;
+	runtime.evictionTimer = setTimeout(() => {
+		runtime.evictionTimer = void 0;
+		evictExpiredRetainedThreads(client, runtime).catch((error) => {
+			embeddedAgentLog.warn("codex retained thread expiry failed", { reason: formatErrorMessage(error) });
+		});
+	}, Math.max(0, expiresAt - Date.now()));
+	runtime.evictionTimer.unref?.();
+}
+async function releaseRetainedThread(client, runtime, threadId) {
+	const pendingRelease = runtime.releasingThreads.get(threadId);
+	if (pendingRelease) {
+		await pendingRelease.completion;
+		return false;
+	}
+	const retained = runtime.retainedThreads.get(threadId);
+	if (!retained) return false;
+	const olderThreadIds = /* @__PURE__ */ new Set();
+	for (const candidateThreadId of runtime.retainedThreads.keys()) {
+		if (candidateThreadId === threadId) break;
+		olderThreadIds.add(candidateThreadId);
+	}
+	runtime.retainedThreads.delete(threadId);
+	scheduleRetainedThreadEviction(client, runtime);
+	const transition = { completion: Promise.resolve().then(() => retained.release(threadId)) };
+	runtime.releasingThreads.set(threadId, transition);
+	try {
+		await transition.completion;
+		return true;
+	} catch (error) {
+		if (!runtime.closed && !transition.invalidated && runtime.releasingThreads.get(threadId) === transition && !runtime.retainedThreads.has(threadId) && !runtime.claimedThreads.has(threadId)) {
+			retained.expiresAt = Date.now() + CODEX_APP_SERVER_LIVE_THREAD_IDLE_TIMEOUT_MS;
+			const newerThreads = [...runtime.retainedThreads.entries()].filter(([candidateThreadId]) => !olderThreadIds.has(candidateThreadId));
+			for (const [candidateThreadId] of newerThreads) runtime.retainedThreads.delete(candidateThreadId);
+			runtime.retainedThreads.set(threadId, retained);
+			for (const [candidateThreadId, newerThread] of newerThreads) runtime.retainedThreads.set(candidateThreadId, newerThread);
+		}
+		throw error;
+	} finally {
+		if (runtime.releasingThreads.get(threadId) === transition) runtime.releasingThreads.delete(threadId);
+		scheduleRetainedThreadEviction(client, runtime);
+	}
+}
+async function evictExpiredRetainedThreads(client, runtime) {
+	const now = Date.now();
+	for (const [threadId, thread] of runtime.retainedThreads) if (thread.expiresAt <= now && !runtime.protectedThreads.has(threadId)) await releaseRetainedThread(client, runtime, threadId);
+	scheduleRetainedThreadEviction(client, runtime);
+}
+async function evictExcessIdleThreads(client, runtime) {
+	let idleThreadIds = [...runtime.retainedThreads.keys()].filter((threadId) => !runtime.protectedThreads.has(threadId));
+	while (idleThreadIds.length > CODEX_APP_SERVER_LIVE_THREAD_MAX_IDLE) {
+		await releaseRetainedThread(client, runtime, idleThreadIds[0]);
+		idleThreadIds = [...runtime.retainedThreads.keys()].filter((threadId) => !runtime.protectedThreads.has(threadId));
+	}
+}
+/** Retain separately owned Codex subscriptions; completing B must never cold-restart A. */
+async function retainCodexAppServerLiveThread(client, threadId, releaseThread, configFingerprint, serviceTier) {
+	const runtime = configuredClients.get(client);
+	if (!runtime || runtime.closed) return false;
+	const claimed = runtime.claimedThreads.get(threadId);
+	if (claimed !== void 0 && (releaseThread === void 0 || claimedThreadReleaseTokens.get(releaseThread) !== claimed)) return false;
+	const pendingRelease = runtime.releasingThreads.get(threadId);
+	if (pendingRelease) {
+		await pendingRelease.completion;
+		if (runtime.closed || claimed !== void 0 && runtime.claimedThreads.get(threadId) !== claimed) return false;
+	}
+	runtime.retainedThreads.delete(threadId);
+	const retained = {
+		configFingerprint,
+		serviceTier,
+		expiresAt: Date.now() + CODEX_APP_SERVER_LIVE_THREAD_IDLE_TIMEOUT_MS,
+		release: (releaseThread ? physicalThreadReleases.get(releaseThread) ?? releaseThread : void 0) ?? (async (releasedThreadId) => {
+			await unsubscribeCodexAppServerLiveThread(client, releasedThreadId, 5e3);
+		})
+	};
+	runtime.retainedThreads.set(threadId, retained);
+	try {
+		await evictExcessIdleThreads(client, runtime);
+	} catch (error) {
+		if (runtime.retainedThreads.get(threadId) === retained) runtime.retainedThreads.delete(threadId);
+		scheduleRetainedThreadEviction(client, runtime);
+		embeddedAgentLog.warn("codex retained thread capacity eviction failed", {
+			threadId,
+			reason: formatErrorMessage(error)
+		});
+		return false;
+	}
+	if (runtime.closed) return false;
+	if (claimed !== void 0 && runtime.claimedThreads.get(threadId) === claimed) runtime.claimedThreads.delete(threadId);
+	scheduleRetainedThreadEviction(client, runtime);
+	return true;
+}
+/** Transfer one idle subscription to its next turn or compaction without touching sibling threads. */
+async function consumeCodexAppServerLiveThread(client, threadId, configFingerprint) {
+	const runtime = configuredClients.get(client);
+	if (!runtime || runtime.closed) return;
+	const pendingRelease = runtime.releasingThreads.get(threadId);
+	if (pendingRelease) {
+		await pendingRelease.completion;
+		return;
+	}
+	const retained = runtime.retainedThreads.get(threadId);
+	if (!retained || configFingerprint !== void 0 && retained.configFingerprint !== configFingerprint) return;
+	return claimCodexAppServerThreadOwnership(client, runtime, threadId, retained);
+}
+/** Claims an observed Codex auto-subscription without exposing a temporarily idle owner. */
+async function claimCodexAppServerLiveThread(client, threadId) {
+	const runtime = configuredClients.get(client);
+	if (!runtime || runtime.closed || runtime.claimedThreads.has(threadId)) return;
+	const pendingRelease = runtime.releasingThreads.get(threadId);
+	if (pendingRelease) {
+		await pendingRelease.completion;
+		return;
+	}
+	return claimCodexAppServerThreadOwnership(client, runtime, threadId, runtime.retainedThreads.get(threadId) ?? {
+		expiresAt: Date.now() + CODEX_APP_SERVER_LIVE_THREAD_IDLE_TIMEOUT_MS,
+		release: async (releasedThreadId) => {
+			await unsubscribeCodexAppServerLiveThread(client, releasedThreadId, 5e3);
+		}
 	});
 }
+function claimCodexAppServerThreadOwnership(client, runtime, threadId, retained) {
+	runtime.retainedThreads.delete(threadId);
+	const claimed = Symbol(threadId);
+	runtime.claimedThreads.set(threadId, claimed);
+	scheduleRetainedThreadEviction(client, runtime);
+	const release = async (releasedThreadId) => {
+		if (releasedThreadId !== threadId || runtime.claimedThreads.get(threadId) !== claimed) return;
+		const pendingRelease = runtime.releasingThreads.get(threadId);
+		if (pendingRelease) {
+			await pendingRelease.completion;
+			return;
+		}
+		const transition = { completion: Promise.resolve().then(async () => {
+			if (runtime.closed || runtime.claimedThreads.get(threadId) !== claimed) return;
+			await retained.release(releasedThreadId);
+		}) };
+		runtime.releasingThreads.set(threadId, transition);
+		try {
+			await transition.completion;
+			if (runtime.claimedThreads.get(threadId) === claimed) runtime.claimedThreads.delete(threadId);
+		} finally {
+			if (runtime.releasingThreads.get(threadId) === transition) runtime.releasingThreads.delete(threadId);
+		}
+	};
+	physicalThreadReleases.set(release, retained.release);
+	claimedThreadReleaseTokens.set(release, claimed);
+	return {
+		configFingerprint: retained.configFingerprint,
+		serviceTier: retained.serviceTier,
+		release
+	};
+}
+/** Distinguish active claimed ownership from an already-evicted idle subscription. */
+function isCodexAppServerLiveThreadClaimed(client, threadId) {
+	const runtime = configuredClients.get(client);
+	return runtime !== void 0 && !runtime.closed && runtime.claimedThreads.has(threadId);
+}
+/** Release the exact physical subscription and finish only its observed claim generation. */
+async function unsubscribeCodexAppServerLiveThread(client, threadId, timeoutMs) {
+	const runtime = configuredClients.get(client);
+	const claimed = runtime?.claimedThreads.get(threadId);
+	let transition = runtime?.releasingThreads.get(threadId);
+	if (transition?.physicalRelease) {
+		await transition.physicalRelease;
+		return;
+	}
+	const physicalRelease = Promise.resolve().then(async () => {
+		if (claimed !== void 0 && runtime?.claimedThreads.get(threadId) !== claimed) return;
+		await client.request("thread/unsubscribe", { threadId }, { timeoutMs });
+	});
+	const ownsTransition = runtime !== void 0 && transition === void 0;
+	if (transition) transition.physicalRelease = physicalRelease;
+	else if (runtime) {
+		transition = {
+			completion: physicalRelease,
+			physicalRelease
+		};
+		runtime.releasingThreads.set(threadId, transition);
+	}
+	try {
+		await physicalRelease;
+		if (claimed !== void 0 && runtime?.claimedThreads.get(threadId) === claimed) runtime.claimedThreads.delete(threadId);
+	} finally {
+		if (ownsTransition && runtime.releasingThreads.get(threadId) === transition) runtime.releasingThreads.delete(threadId);
+	}
+}
+/** Reset/end owns the exact thread; failed generation retirement must never release its successor. */
+async function releaseCodexAppServerLiveThread(client, threadId) {
+	const runtime = configuredClients.get(client);
+	return runtime ? await releaseRetainedThread(client, runtime, threadId) : false;
+}
+/** Native child work pins its parent's subscription even after the foreground parent turn ends. */
+function protectCodexAppServerLiveThread(client, threadId) {
+	const runtime = configuredClients.get(client);
+	if (!runtime || runtime.closed) return () => void 0;
+	runtime.protectedThreads.set(threadId, (runtime.protectedThreads.get(threadId) ?? 0) + 1);
+	scheduleRetainedThreadEviction(client, runtime);
+	let protectedThread = true;
+	return () => {
+		if (!protectedThread) return;
+		protectedThread = false;
+		if (runtime.closed) return;
+		const count = runtime.protectedThreads.get(threadId) ?? 0;
+		if (count <= 1) {
+			runtime.protectedThreads.delete(threadId);
+			const retained = runtime.retainedThreads.get(threadId);
+			if (retained) {
+				runtime.retainedThreads.delete(threadId);
+				runtime.retainedThreads.set(threadId, {
+					...retained,
+					expiresAt: Date.now() + CODEX_APP_SERVER_LIVE_THREAD_IDLE_TIMEOUT_MS
+				});
+			}
+		} else runtime.protectedThreads.set(threadId, count - 1);
+		scheduleRetainedThreadEviction(client, runtime);
+		evictExcessIdleThreads(client, runtime).catch((error) => {
+			embeddedAgentLog.warn("codex retained thread unpin eviction failed", {
+				threadId,
+				reason: formatErrorMessage(error)
+			});
+		});
+	};
+}
+//#endregion
+//#region extensions/codex/src/app-server/rpc-error.ts
+/** RPC error wrapper that preserves app-server error code and data. */
+var CodexAppServerRpcError = class extends Error {
+	constructor(error, method) {
+		super(formatCodexAppServerRpcErrorMessage(error, method));
+		this.name = "CodexAppServerRpcError";
+		this.code = error.code;
+		this.data = error.data;
+		this.method = method;
+	}
+};
+function formatCodexAppServerRpcErrorMessage(error, method) {
+	const message = error.message || `${method} failed`;
+	const detail = readCodexAppServerRpcReloginDetail(error.data);
+	return detail && !message.includes(detail) ? `${message}: ${detail}` : message;
+}
+function readCodexAppServerRpcReloginDetail(data) {
+	const record = isJsonObject(data) ? data : void 0;
+	const nested = isJsonObject(record?.error) ? record.error : record;
+	if (!nested) return;
+	const isRelogin = nested.action === "relogin" || nested.reason === "cloudRequirements" && nested.errorCode === "Auth";
+	const detail = typeof nested.detail === "string" ? nested.detail.trim() : "";
+	return isRelogin && detail ? detail : void 0;
+}
 //#endregion
 //#region extensions/codex/src/app-server/transport-websocket.ts
 /**
 * Adapts a remote Codex app-server WebSocket endpoint to the shared stdio-like
 * transport interface.
 */
+const WEBSOCKET_HANDSHAKE_TIMEOUT_MS = 1e4;
+const WEBSOCKET_PING_INTERVAL_MS = 2e4;
+const WEBSOCKET_PONG_TIMEOUT_MS = 2e4;
+const MAX_CONSECUTIVE_MISSED_WEBSOCKET_PONGS = 5;
 /** Opens a WebSocket app-server transport and maps newline-delimited frames to stdout/stdin. */
 function createWebSocketTransport(options) {
 	if (!options.url) throw new Error("codex app-server websocket transport requires plugins.entries.codex.config.appServer.url");
@@ -1161,7 +1407,8 @@ function createWebSocketTransport(options) {
 			...options.headers,
 			...options.authToken ? { Authorization: `Bearer ${options.authToken}` } : {}
 		},
-		perMessageDeflate: false
+		perMessageDeflate: false,
+		...options.transport === "websocket" ? { handshakeTimeout: WEBSOCKET_HANDSHAKE_TIMEOUT_MS } : {}
 	};
 	const unixSocketPath = resolveCodexAppServerUnixSocketPath(options);
 	const socket = unixSocketPath ? new WebSocket("ws://localhost/", {
@@ -1172,6 +1419,58 @@ function createWebSocketTransport(options) {
 	const stdinDecoder = new StringDecoder("utf8");
 	let pendingLine = "";
 	let killed = false;
+	let pingTimeout;
+	let pongTimeout;
+	let expectedPong;
+	let consecutiveMissedPongs = 0;
+	let heartbeatSequence = 0;
+	const clearConnectionHealthTimers = () => {
+		if (pingTimeout) {
+			clearTimeout(pingTimeout);
+			pingTimeout = void 0;
+		}
+		if (pongTimeout) {
+			clearTimeout(pongTimeout);
+			pongTimeout = void 0;
+		}
+		expectedPong = void 0;
+	};
+	const sendHeartbeatPing = () => {
+		if (socket.readyState !== WebSocket.OPEN || pongTimeout) return;
+		const payload = Buffer.from(`openclaw-codex-${++heartbeatSequence}`);
+		expectedPong = payload;
+		pongTimeout = setTimeout(() => {
+			pongTimeout = void 0;
+			expectedPong = void 0;
+			consecutiveMissedPongs += 1;
+			if (consecutiveMissedPongs >= MAX_CONSECUTIVE_MISSED_WEBSOCKET_PONGS) {
+				socket.terminate();
+				return;
+			}
+			sendHeartbeatPing();
+		}, WEBSOCKET_PONG_TIMEOUT_MS);
+		pongTimeout.unref();
+		socket.ping(payload, void 0, (error) => {
+			if (error) socket.terminate();
+		});
+	};
+	const scheduleHeartbeatPing = () => {
+		if (options.transport !== "websocket" || socket.readyState !== WebSocket.OPEN || pingTimeout || pongTimeout) return;
+		pingTimeout = setTimeout(() => {
+			pingTimeout = void 0;
+			sendHeartbeatPing();
+		}, WEBSOCKET_PING_INTERVAL_MS);
+		pingTimeout.unref();
+	};
+	const recordConnectionActivity = () => {
+		consecutiveMissedPongs = 0;
+		if (pongTimeout) {
+			clearTimeout(pongTimeout);
+			pongTimeout = void 0;
+		}
+		expectedPong = void 0;
+		scheduleHeartbeatPing();
+	};
 	const sendFrame = (frame) => {
 		const trimmed = frame.trim();
 		if (!trimmed) return;
@@ -1183,13 +1482,22 @@ function createWebSocketTransport(options) {
 	};
 	socket.once("open", () => {
 		for (const frame of pendingFrames.splice(0)) socket.send(frame);
+		scheduleHeartbeatPing();
+	});
+	socket.on("pong", (payload) => {
+		if (expectedPong?.equals(payload)) recordConnectionActivity();
+	});
+	socket.once("error", (error) => {
+		clearConnectionHealthTimers();
+		events.emit("error", error);
 	});
-	socket.once("error", (error) => events.emit("error", error));
 	socket.once("close", (code, reason) => {
+		clearConnectionHealthTimers();
 		killed = true;
 		events.emit("exit", code, reason.toString("utf8"));
 	});
 	socket.on("message", (data) => {
+		if (options.transport === "websocket") recordConnectionActivity();
 		const text = websocketFrameToText(data);
 		stdout.write(text.endsWith("\n") ? text : `${text}\n`);
 	});
@@ -1223,6 +1531,7 @@ function createWebSocketTransport(options) {
 		},
 		kill: () => {
 			killed = true;
+			clearConnectionHealthTimers();
 			socket.close();
 		},
 		once: (event, listener) => events.once(event, listener)
@@ -1309,10 +1618,8 @@ function signalCodexAppServerTransport(child, signal) {
 /**
 * Version and package pins for the managed Codex app-server runtime.
 */
-/** Minimum Codex app-server version supported by the OpenClaw Codex bridge. */
-const MIN_CODEX_APP_SERVER_VERSION = "0.143.0";
-/** Newest Codex app-server version validated by the OpenClaw Codex bridge. */
-const MAX_CODEX_APP_SERVER_VERSION = "0.145.0";
+/** Exact Codex app-server version shipped and supported by the OpenClaw Codex bridge. */
+const CODEX_APP_SERVER_VERSION = "0.147.0";
 /** npm package name for the managed Codex app-server binary. */
 const MANAGED_CODEX_APP_SERVER_PACKAGE = "@openai/codex";
 //#endregion
@@ -1321,7 +1628,6 @@ const MANAGED_CODEX_APP_SERVER_PACKAGE = "@openai/codex";
 * JSON-RPC client for Codex app-server transports, including request/response
 * routing, notification fanout, server request handlers, and version checks.
 */
-/** Minimum supported Codex app-server version exported for callers/tests. */
 const CODEX_APP_SERVER_PARSE_LOG_MAX = 500;
 const CODEX_APP_SERVER_PARSE_BUFFER_MAX = 8 * 1024 * 1024;
 const CODEX_APP_SERVER_PARSE_BUFFER_MAX_LINES = 1e3;
@@ -1343,16 +1649,6 @@ function getCodexAppServerClientInstanceId(client) {
 function resolveCodexAppServerClientInstanceId(client) {
 	return client.getInstanceId?.call(client) ?? getCodexAppServerClientInstanceId(client);
 }
-/** RPC error wrapper that preserves app-server error code and data. */
-var CodexAppServerRpcError = class extends Error {
-	constructor(error, method) {
-		super(formatCodexAppServerRpcErrorMessage(error, method));
-		this.name = "CodexAppServerRpcError";
-		this.code = error.code;
-		this.data = error.data;
-		this.method = method;
-	}
-};
 var CodexAppServerLocalRequestCancellationError = class extends Error {
 	constructor(method, reason, mayHaveWritten) {
 		super(`${method} ${reason}`);
@@ -1395,22 +1691,6 @@ function isCodexAppServerPrewriteRequestCancellationError(error) {
 function isCodexAppServerIndeterminateTransportError(error) {
 	return error instanceof Error && "code" in error && error.code === "CODEX_APP_SERVER_REQUEST_TRANSPORT_INDETERMINATE" && "mayHaveWritten" in error && error.mayHaveWritten === true;
 }
-function formatCodexAppServerRpcErrorMessage(error, method) {
-	const message = error.message || `${method} failed`;
-	const detail = readCodexAppServerRpcReloginDetail(error.data);
-	return detail && !message.includes(detail) ? `${message}: ${detail}` : message;
-}
-function readCodexAppServerRpcReloginDetail(data) {
-	const record = isJsonObject(data) ? data : void 0;
-	const nested = isJsonObject(record?.error) ? record.error : record;
-	if (!nested) return;
-	const isRelogin = nested.action === "relogin" || nested.reason === "cloudRequirements" && nested.errorCode === "Auth";
-	const detail = typeof nested.detail === "string" ? nested.detail.trim() : "";
-	return isRelogin && detail ? detail : void 0;
-}
-function isJsonObject(value) {
-	return Boolean(value && typeof value === "object" && !Array.isArray(value));
-}
 /** Returns true for errors that mean the app-server transport is closed. */
 function isCodexAppServerConnectionClosedError(error) {
 	if (!(error instanceof Error)) return false;
@@ -1433,8 +1713,8 @@ var CodexAppServerClient = class CodexAppServerClient {
 		this.child = child;
 		this.lines = createInterface({ input: child.stdout });
 		this.lines.on("line", (line) => this.handleLine(line));
-		this.lines.on("error", (error) => this.closeWithError(error instanceof Error ? error : new Error(String(error))));
-		child.stdout.on("error", (error) => this.closeWithError(error instanceof Error ? error : new Error(String(error))));
+		this.lines.on("error", (error) => this.closeWithError(toStringifiedError(error)));
+		child.stdout.on("error", (error) => this.closeWithError(toStringifiedError(error)));
 		child.stderr.setEncoding("utf8");
 		child.stderr.on("data", (text) => {
 			this.stderrTail = appendBoundedTail(this.stderrTail, text, CODEX_APP_SERVER_STDERR_TAIL_MAX);
@@ -1444,12 +1724,12 @@ var CodexAppServerClient = class CodexAppServerClient {
 		child.stderr.on("error", (error) => {
 			embeddedAgentLog.warn("codex app-server stderr stream failed", { error });
 		});
-		child.once("error", (error) => this.closeWithError(error instanceof Error ? error : new Error(String(error))));
+		child.once("error", (error) => this.closeWithError(toStringifiedError(error)));
 		child.once("exit", (code, signal) => {
 			this.transportExited = true;
 			this.closeWithError(buildCodexAppServerExitError(code, signal, this.stderrTail));
 		});
-		child.stdin.on?.("error", (error) => this.closeWithError(error instanceof Error ? error : new Error(String(error))));
+		child.stdin.on?.("error", (error) => this.closeWithError(toStringifiedError(error)));
 	}
 	/** Starts a new app-server client using resolved runtime start options. */
 	static start(options) {
@@ -1491,6 +1771,14 @@ var CodexAppServerClient = class CodexAppServerClient {
 	getRuntimeIdentity() {
 		return this.runtimeIdentity ? { ...this.runtimeIdentity } : void 0;
 	}
+	/** Returns a bounded, redacted stderr diagnostic from the app-server process. */
+	getStderrDiagnostic() {
+		return redactCodexAppServerLinePreview(this.stderrTail) || void 0;
+	}
+	/** Returns the terminal transport error that closed this physical client. */
+	getCloseError() {
+		return this.closeError;
+	}
 	/** Stable generation id for this exact physical client instance. */
 	getInstanceId() {
 		return this.instanceId;
@@ -1660,7 +1948,7 @@ var CodexAppServerClient = class CodexAppServerClient {
 				onWriteAttempt?.();
 				this.writeMessage(message, (error) => rejectPending(error));
 			} catch (error) {
-				rejectPending(error instanceof Error ? error : new Error(String(error)));
+				rejectPending(toStringifiedError(error));
 			}
 		});
 	}
@@ -1831,7 +2119,7 @@ var CodexAppServerClient = class CodexAppServerClient {
 				result: defaultServerRequestResponse(request)
 			});
 		} catch (error) {
-			const message = error instanceof Error ? error.message : String(error);
+			const message = coerceErrorMessage(error);
 			embeddedAgentLog.warn("codex app-server server request handler failed", {
 				id: request.id,
 				method: request.method,
@@ -1876,9 +2164,13 @@ var CodexAppServerClient = class CodexAppServerClient {
 		}
 	}
 	handleNotification(notification) {
-		for (const handler of this.notificationHandlers) Promise.resolve(handler(notification)).catch((error) => {
+		for (const handler of this.notificationHandlers) try {
+			Promise.resolve(handler(notification)).catch((error) => {
+				embeddedAgentLog.warn("codex app-server notification handler failed", { error });
+			});
+		} catch (error) {
 			embeddedAgentLog.warn("codex app-server notification handler failed", { error });
-		});
+		}
 	}
 	closeWithError(error) {
 		if (this.markClosed(error)) closeCodexAppServerTransport(this.child);
@@ -1934,25 +2226,24 @@ function timeoutServerRequestResponse(request) {
 var CodexAppServerVersionError = class extends Error {
 	constructor(detectedVersion) {
 		const detected = detectedVersion ? `detected ${detectedVersion}` : "OpenClaw could not determine the running Codex version";
-		super(`A stable Codex app-server from ${MIN_CODEX_APP_SERVER_VERSION} through ${MAX_CODEX_APP_SERVER_VERSION} is required, but ${detected}. Update the configured Codex app-server binary, or remove custom command overrides to use the managed binary.`);
+		super(`Codex app-server ${CODEX_APP_SERVER_VERSION} is required, but ${detected}. Update the configured Codex app-server binary, or remove custom command overrides to use the managed binary.`);
 		this.name = "CodexAppServerVersionError";
 		this.detectedVersion = detectedVersion;
 	}
 };
 function assertSupportedCodexAppServerVersion(response) {
 	const detectedVersion = readCodexVersionFromUserAgent(response.userAgent);
-	const parsedVersion = parse(detectedVersion ?? "");
-	if (!detectedVersion || !parsedVersion || parsedVersion.compare("0.143.0") < 0 || parsedVersion.compare("0.145.0") > 0 || parsedVersion.prerelease.length > 0 || parsedVersion.build.length > 0) throw new CodexAppServerVersionError(detectedVersion);
+	if (detectedVersion !== "0.147.0") throw new CodexAppServerVersionError(detectedVersion);
 	return detectedVersion;
 }
 function isUnsupportedCodexAppServerVersionError(error) {
 	return error instanceof CodexAppServerVersionError;
 }
 function buildCodexAppServerRuntimeIdentity(response, serverVersion) {
-	const userAgent = readNonEmptyInitializeString(response.userAgent);
-	const codexHome = readNonEmptyInitializeString(response.codexHome);
-	const platformFamily = readNonEmptyInitializeString(response.platformFamily);
-	const platformOs = readNonEmptyInitializeString(response.platformOs);
+	const userAgent = normalizeOptionalString(response.userAgent);
+	const codexHome = normalizeOptionalString(response.codexHome);
+	const platformFamily = normalizeOptionalString(response.platformFamily);
+	const platformOs = normalizeOptionalString(response.platformOs);
 	return {
 		serverVersion,
 		...userAgent ? { userAgent } : {},
@@ -1961,10 +2252,6 @@ function buildCodexAppServerRuntimeIdentity(response, serverVersion) {
 		...platformOs ? { platformOs } : {}
 	};
 }
-function readNonEmptyInitializeString(value) {
-	const trimmed = value?.trim();
-	return trimmed ? trimmed : void 0;
-}
 /** Extracts the Codex version from the app-server initialize user-agent field. */
 function readCodexVersionFromUserAgent(userAgent) {
 	return (userAgent?.match(/^[^/]+\/(\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?)(?:[\s(]|$)/))?.[1];
@@ -1984,7 +2271,7 @@ function buildCodexAppServerExitError(code, signal, stderrTail) {
 }
 function shouldBufferCodexAppServerParseFailure(value, error) {
 	if (!value.startsWith("{") && !value.startsWith("[")) return false;
-	const message = error instanceof Error ? error.message : String(error);
+	const message = coerceErrorMessage(error);
 	return message.includes("Unterminated string") || message.includes("Unexpected end of JSON input");
 }
 function logCodexAppServerParseFailure(value, error, fragmentCount) {
@@ -1992,7 +2279,7 @@ function logCodexAppServerParseFailure(value, error, fragmentCount) {
 	const suffix = fragmentCount > 1 ? ` fragments=${fragmentCount}` : "";
 	embeddedAgentLog.warn("failed to parse codex app-server message", {
 		error,
-		errorMessage: error instanceof Error ? error.message : String(error),
+		errorMessage: coerceErrorMessage(error),
 		fragmentCount,
 		linePreview,
 		consoleMessage: `failed to parse codex app-server message${suffix}: preview=${JSON.stringify(linePreview)}`
@@ -2013,6 +2300,103 @@ function formatExitValue(value) {
 	return "unknown";
 }
 //#endregion
+//#region extensions/codex/src/app-server/attempt-timeouts.ts
+/**
+* Timeout defaults and normalizers for Codex app-server startup and turn
+* liveness watches.
+*/
+/** Minimum startup timeout accepted by the Codex app-server harness. */
+const CODEX_APP_SERVER_STARTUP_TIMEOUT_FLOOR_MS = 100;
+/** Default idle timeout while waiting for app-server turn completion. */
+const CODEX_TURN_COMPLETION_IDLE_TIMEOUT_MS = 6e4;
+/** Short guard after apparent assistant completion. */
+const CODEX_TURN_ASSISTANT_COMPLETION_IDLE_TIMEOUT_MS = 1e4;
+const CODEX_POST_TOOL_RAW_ASSISTANT_COMPLETION_IDLE_TIMEOUT_MS = 5 * 6e4;
+/** Guard after reasoning/commentary progress when no tool handoff occurred. */
+const CODEX_POST_REASONING_REPLY_IDLE_TIMEOUT_MS = 5 * 6e4;
+/** Long terminal idle watch for app-server turns that never send completion. */
+const CODEX_TURN_TERMINAL_IDLE_TIMEOUT_MS = 30 * 6e4;
+var CodexAppServerStartupError = class extends Error {
+	constructor(reason, message = reason === "timed_out" ? "codex app-server startup timed out" : "codex app-server startup aborted") {
+		super(message);
+		this.reason = reason;
+		this.code = "CODEX_APP_SERVER_STARTUP_CANCELLED";
+		this.name = "CodexAppServerStartupError";
+	}
+};
+function isCodexAppServerStartupError(error, reason) {
+	return error instanceof Error && "code" in error && error.code === "CODEX_APP_SERVER_STARTUP_CANCELLED" && "reason" in error && (error.reason === "aborted" || error.reason === "timed_out") && (reason === void 0 || error.reason === reason);
+}
+function resolvePositiveIntegerTimeoutMs(value, fallbackMs) {
+	return resolveTimerTimeoutMs(value, resolveTimerTimeoutMs(fallbackMs, 1));
+}
+/** Runs startup work with abort and timeout handling plus optional cleanup. */
+async function withCodexStartupTimeout(params) {
+	if (params.signal.aborted) throw new CodexAppServerStartupError("aborted");
+	let timeout;
+	let abortCleanup;
+	let timeoutError;
+	let timeoutCleanup;
+	try {
+		return await Promise.race([params.operation(), new Promise((_, reject) => {
+			const rejectOnce = (error) => {
+				if (timeout) {
+					clearTimeout(timeout);
+					timeout = void 0;
+				}
+				reject(error);
+			};
+			timeout = setTimeout(() => {
+				timeoutError = new CodexAppServerStartupError("timed_out");
+				timeoutCleanup = Promise.resolve(params.onTimeout?.()).then(() => void 0, () => void 0);
+				timeoutCleanup.finally(() => {
+					rejectOnce(timeoutError);
+				});
+			}, params.timeoutMs);
+			const abortListener = () => rejectOnce(new CodexAppServerStartupError("aborted"));
+			params.signal.addEventListener("abort", abortListener, { once: true });
+			abortCleanup = () => params.signal.removeEventListener("abort", abortListener);
+		})]);
+	} catch (error) {
+		if (timeoutError) {
+			await timeoutCleanup;
+			throw timeoutError;
+		}
+		throw error;
+	} finally {
+		if (timeout) clearTimeout(timeout);
+		abortCleanup?.();
+	}
+}
+/** Resolves startup timeout while honoring the configured floor. */
+function resolveCodexStartupTimeoutMs(params) {
+	const timeoutFloorMs = resolvePositiveIntegerTimeoutMs(params.timeoutFloorMs, CODEX_APP_SERVER_STARTUP_TIMEOUT_FLOOR_MS);
+	const timeoutMs = resolvePositiveIntegerTimeoutMs(params.timeoutMs, timeoutFloorMs);
+	return Math.max(timeoutFloorMs, timeoutMs);
+}
+/** Resolves the completion-idle timeout for an active turn. */
+function resolveCodexTurnCompletionIdleTimeoutMs(value) {
+	return resolvePositiveIntegerTimeoutMs(value, CODEX_TURN_COMPLETION_IDLE_TIMEOUT_MS);
+}
+/** Resolves the short assistant-completion release timeout. */
+function resolveCodexTurnAssistantCompletionIdleTimeoutMs(value) {
+	return resolvePositiveIntegerTimeoutMs(value, CODEX_TURN_ASSISTANT_COMPLETION_IDLE_TIMEOUT_MS);
+}
+/** Resolves the conservative post-tool raw assistant guard timeout. */
+function resolveCodexPostToolRawAssistantCompletionIdleTimeoutMs(value, fallbackMs) {
+	return resolvePositiveIntegerTimeoutMs(value, Math.max(resolvePositiveIntegerTimeoutMs(void 0, fallbackMs), CODEX_POST_TOOL_RAW_ASSISTANT_COMPLETION_IDLE_TIMEOUT_MS));
+}
+/** Resolves the long terminal turn idle timeout. */
+function resolveCodexTurnTerminalIdleTimeoutMs(value, runTimeoutOverrideMs) {
+	const explicitRunBudgetMs = resolvePositiveIntegerTimeoutMs(runTimeoutOverrideMs, CODEX_TURN_TERMINAL_IDLE_TIMEOUT_MS);
+	return resolvePositiveIntegerTimeoutMs(value, Math.max(CODEX_TURN_TERMINAL_IDLE_TIMEOUT_MS, explicitRunBudgetMs));
+}
+/** Adds gateway grace time to a caller timeout without overflowing invalid values. */
+function resolveCodexGatewayTimeoutWithGraceMs(timeoutMs, graceMs = 1e4) {
+	const timeout = resolvePositiveIntegerTimeoutMs(timeoutMs, 1);
+	return addTimerTimeoutGraceMs(timeout, resolveTimerTimeoutMs(graceMs, 0, 0)) ?? timeout;
+}
+//#endregion
 //#region extensions/codex/src/app-server/managed-binary.ts
 /**
 * Resolves the managed Codex app-server binary shipped with or installed beside
@@ -2178,15 +2562,13 @@ function resolveManagedCodexPackageBinCandidate(root) {
 		const packageJsonPath = createRequire(path.join(root, "package.json")).resolve(`${MANAGED_CODEX_APP_SERVER_PACKAGE}/package.json`);
 		const packageRoot = path.dirname(packageJsonPath);
 		const packageJson = JSON.parse(readFileSync(packageJsonPath, "utf8"));
-		const binPath = typeof packageJson.bin === "string" ? packageJson.bin : isRecord(packageJson.bin) && typeof packageJson.bin.codex === "string" ? packageJson.bin.codex : null;
+		const packageBin = packageJson.bin && typeof packageJson.bin === "object" ? packageJson.bin : void 0;
+		const binPath = typeof packageJson.bin === "string" ? packageJson.bin : typeof packageBin?.codex === "string" ? packageBin.codex : null;
 		return binPath ? path.resolve(packageRoot, binPath) : null;
 	} catch {
 		return null;
 	}
 }
-function isRecord(value) {
-	return typeof value === "object" && value !== null;
-}
 function isDistExtensionRoot(pluginRoot, platform) {
 	const pathApi = pathForPlatform(platform);
 	const extensionsDir = pathApi.dirname(pluginRoot);
@@ -2282,6 +2664,9 @@ async function waitForPreviousFence(previous, options) {
 * Thin Codex app-server timeout adapter around OpenClaw's shared security
 * runtime timeout helper.
 */
+function resolveAbortError(signal) {
+	return signal.reason instanceof Error ? signal.reason : new Error("Codex app-server operation aborted", { cause: signal.reason });
+}
 /** Awaits a promise with a Codex-specific timeout error message. */
 async function withTimeout$1(promise, timeoutMs, timeoutMessage, createError) {
 	return await withTimeout(promise, timeoutMs, {
@@ -2289,6 +2674,22 @@ async function withTimeout$1(promise, timeoutMs, timeoutMessage, createError) {
 		...createError ? { createError } : {}
 	});
 }
+/** Bounds an operation by both its owner lifecycle and one total wall-clock budget. */
+async function withAbortableTimeout(params) {
+	const signal = params.signal;
+	if (signal?.aborted) throw resolveAbortError(signal);
+	let removeAbortListener;
+	const operation = signal ? Promise.race([params.promise, new Promise((_, reject) => {
+		const onAbort = () => reject(resolveAbortError(signal));
+		signal.addEventListener("abort", onAbort, { once: true });
+		removeAbortListener = () => signal.removeEventListener("abort", onAbort);
+	})]) : params.promise;
+	try {
+		return await withTimeout$1(operation, params.timeoutMs, params.timeoutMessage, params.createTimeoutError);
+	} finally {
+		removeAbortListener?.();
+	}
+}
 //#endregion
 //#region extensions/codex/src/app-server/shared-client.ts
 /**
@@ -2309,11 +2710,12 @@ var shared_client_exports = /* @__PURE__ */ __exportAll({
 	releaseLeasedSharedCodexAppServerClient: () => releaseLeasedSharedCodexAppServerClient,
 	resolveCodexAppServerSpawnIdentity: () => resolveCodexAppServerSpawnIdentity,
 	resolveCodexNativeConfigFenceKey: () => resolveCodexNativeConfigFenceKey,
+	retainSharedCodexAppServerClientByInstanceId: () => retainSharedCodexAppServerClientByInstanceId,
 	retainSharedCodexAppServerClientIfCurrent: () => retainSharedCodexAppServerClientIfCurrent,
 	retireSharedCodexAppServerClientIfCurrent: () => retireSharedCodexAppServerClientIfCurrent,
 	withLeasedCodexAppServerClientStartSelectionRetry: () => withLeasedCodexAppServerClientStartSelectionRetry
 });
-const suspectClosedClients = /* @__PURE__ */ new WeakSet();
+const CODEX_APP_SERVER_INITIALIZE_TIMEOUT_MESSAGE = "codex app-server initialize timed out";
 const SHARED_CODEX_APP_SERVER_CLIENT_STATE = Symbol.for("openclaw.codexAppServerClientState");
 const SHARED_CODEX_APP_SERVER_CLIENT_DISPOSER = Symbol.for("openclaw.codexAppServerClientDisposer");
 const CODEX_APP_SERVER_CLIENT_START_METADATA = Symbol.for("openclaw.codexAppServerClientStartMetadata");
@@ -2321,6 +2723,8 @@ function getSharedCodexAppServerClientState() {
 	const globalState = globalThis;
 	globalState[SHARED_CODEX_APP_SERVER_CLIENT_STATE] ??= {
 		clients: /* @__PURE__ */ new Map(),
+		liveClients: /* @__PURE__ */ new Set(),
+		entriesByClient: /* @__PURE__ */ new WeakMap(),
 		leasedReleases: /* @__PURE__ */ new WeakMap()
 	};
 	return globalState[SHARED_CODEX_APP_SERVER_CLIENT_STATE];
@@ -2435,15 +2839,55 @@ async function resolveCodexAppServerClientStartContext(options) {
 				startOptions: requestedStartOptions,
 				agentDir
 			})),
+			agentId: options?.agentId,
 			agentDir,
 			authProfileId: usesNativeAuth || preparedAuth?.kind === "api-key" ? null : authProfileId,
 			...resolvedPreparedAuth ? { preparedAuth: resolvedPreparedAuth } : {},
+			authRequirement,
 			config: options?.config,
 			pluginConfig: options?.pluginConfig,
 			...authProfileStore ? { authProfileStore } : {}
 		})
 	};
 }
+function resolveWarmSharedCodexAppServerClientIdentity(options) {
+	if (!options?.config || typeof options.config !== "object" || !options.startOptions || options.pluginConfig !== void 0 || options.authProfileStore !== void 0 || options.preparedAuth !== void 0 || options.runtimeArtifactMode !== void 0 || options.expectedRuntimeArtifact !== void 0) return;
+	const authProfileSelector = options.authProfileId === null ? ["native"] : options.authProfileId === void 0 ? ["implicit"] : ["profile", options.authProfileId];
+	return {
+		config: options.config,
+		startOptions: options.startOptions,
+		selectorKey: JSON.stringify([
+			options.agentDir ?? resolveDefaultAgentDir(options.config),
+			authProfileSelector,
+			options.authBindingFingerprint ?? null,
+			options.authRequirement ?? null
+		])
+	};
+}
+function readWarmSharedCodexAppServerClient(state, identity) {
+	const aliases = state.warmClientsByConfig?.get(identity.config)?.get(identity.startOptions);
+	const warm = aliases?.get(identity.selectorKey);
+	if (!warm) return;
+	if (state.clients.get(warm.key) !== warm.entry || warm.entry.client !== warm.client || warm.entry.closeWhenIdle || warm.entry.closeError) {
+		aliases?.delete(identity.selectorKey);
+		return;
+	}
+	return warm;
+}
+function rememberWarmSharedCodexAppServerClient(state, identity, warm) {
+	state.warmClientsByConfig ??= /* @__PURE__ */ new WeakMap();
+	let byStartOptions = state.warmClientsByConfig.get(identity.config);
+	if (!byStartOptions) {
+		byStartOptions = /* @__PURE__ */ new WeakMap();
+		state.warmClientsByConfig.set(identity.config, byStartOptions);
+	}
+	let aliases = byStartOptions.get(identity.startOptions);
+	if (!aliases) {
+		aliases = /* @__PURE__ */ new Map();
+		byStartOptions.set(identity.startOptions, aliases);
+	}
+	aliases.set(identity.selectorKey, warm);
+}
 /** Gets or starts a shared Codex app-server client without retaining a lease. */
 async function getSharedCodexAppServerClient(options) {
 	return (await acquireSharedCodexAppServerClient(options)).client;
@@ -2513,6 +2957,17 @@ async function withLeasedCodexAppServerClientStartSelectionRetry(params) {
 }
 async function acquireSharedCodexAppServerClient(options, leaseOptions) {
 	if (options?.abandonSignal?.aborted) throw new CodexAppServerStartupError("aborted", "codex app-server initialize aborted");
+	const state = getSharedCodexAppServerClientState();
+	const warmIdentity = resolveWarmSharedCodexAppServerClientIdentity(options);
+	const warmClient = warmIdentity ? readWarmSharedCodexAppServerClient(state, warmIdentity) : void 0;
+	if (warmClient) {
+		options?.onStartedClient?.(warmClient.client);
+		const release = leaseOptions?.leased ? retainSharedClientEntry(warmClient.entry) : void 0;
+		return release ? {
+			client: warmClient.client,
+			release
+		} : { client: warmClient.client };
+	}
 	const acquireStartedAt = Date.now();
 	const timeoutMs = options?.timeoutMs ?? 0;
 	const { agentDir, usesNativeAuth, authProfileId, authProfileStore, preparedAuth, authRequirement, requestedStartOptions, startOptions } = await withCodexAppServerAcquireDeadline(timeoutMs, resolveCodexAppServerClientStartContext(options), options?.abandonSignal);
@@ -2527,7 +2982,7 @@ async function acquireSharedCodexAppServerClient(options, leaseOptions) {
 	const runtimeArtifactMode = options?.runtimeArtifactMode ?? (options?.expectedRuntimeArtifact ? "capture" : void 0);
 	const expectedRuntimeArtifactKey = options?.expectedRuntimeArtifact ? createHash("sha256").update(options.expectedRuntimeArtifact.id).update("\0").update(options.expectedRuntimeArtifact.fingerprint).digest("hex") : "mint";
 	const key = runtimeArtifactMode ? `${baseKey}\0runtime-artifact:capture-v1:${expectedRuntimeArtifactKey}` : baseKey;
-	const entry = getOrCreateSharedClientEntry(getSharedCodexAppServerClientState(), key);
+	const entry = getOrCreateSharedClientEntry(state, key);
 	if (runtimeArtifactMode) entry.runtimeArtifactStartupAbort ??= new AbortController();
 	entry.closeWhenIdle = false;
 	const releasePendingAcquire = retainPendingSharedClientAcquire(entry);
@@ -2566,7 +3021,7 @@ async function acquireSharedCodexAppServerClient(options, leaseOptions) {
 		config: options?.config
 	}));
 	try {
-		await withCodexAppServerAcquireDeadline(remainingTimeoutMs, startup.initialized, options?.abandonSignal);
+		await withCodexAppServerAcquireDeadline(remainingTimeoutMs, startup.initialized, options?.abandonSignal, CODEX_APP_SERVER_INITIALIZE_TIMEOUT_MESSAGE, () => buildCodexAppServerInitializeTimeoutError(entry.client));
 		const client = await withCodexAppServerAcquireDeadline(timeoutMs, startup.ready, options?.abandonSignal, "codex app-server authentication timed out");
 		if (entry.closeError) throw entry.closeError;
 		ensureCodexAppServerClientRuntime(client, {
@@ -2577,6 +3032,11 @@ async function acquireSharedCodexAppServerClient(options, leaseOptions) {
 			config: options?.config
 		});
 		const release = leaseOptions?.leased ? retainSharedClientEntry(entry) : void 0;
+		if (warmIdentity) rememberWarmSharedCodexAppServerClient(state, warmIdentity, {
+			key,
+			entry,
+			client
+		});
 		return release ? {
 			client,
 			release
@@ -2591,9 +3051,9 @@ async function acquireSharedCodexAppServerClient(options, leaseOptions) {
 		releasePendingAcquire();
 	}
 }
-async function withCodexAppServerAcquireDeadline(timeoutMs, promise, signal, timeoutMessage = "codex app-server initialize timed out") {
+async function withCodexAppServerAcquireDeadline(timeoutMs, promise, signal, timeoutMessage = CODEX_APP_SERVER_INITIALIZE_TIMEOUT_MESSAGE, timeoutErrorFactory) {
 	if (signal?.aborted) throw new CodexAppServerStartupError("aborted", "codex app-server initialize aborted");
-	const timed = withTimeout$1(promise, timeoutMs, timeoutMessage, () => new CodexAppServerStartupError("timed_out", timeoutMessage));
+	const timed = withTimeout$1(promise, timeoutMs, timeoutMessage, () => timeoutErrorFactory?.() ?? new CodexAppServerStartupError("timed_out", timeoutMessage));
 	if (!signal) return await timed;
 	return await new Promise((resolve, reject) => {
 		const onAbort = () => reject(new CodexAppServerStartupError("aborted", "codex app-server initialize aborted"));
@@ -2601,6 +3061,10 @@ async function withCodexAppServerAcquireDeadline(timeoutMs, promise, signal, tim
 		timed.then(resolve, reject).finally(() => signal.removeEventListener("abort", onAbort));
 	});
 }
+function buildCodexAppServerInitializeTimeoutError(client) {
+	const stderr = client?.getStderrDiagnostic();
+	return new CodexAppServerStartupError("timed_out", stderr ? `${CODEX_APP_SERVER_INITIALIZE_TIMEOUT_MESSAGE}; stderr=${JSON.stringify(stderr)}` : CODEX_APP_SERVER_INITIALIZE_TIMEOUT_MESSAGE);
+}
 function resolveRemainingAcquireTimeout(timeoutMs, startedAt) {
 	if (!(timeoutMs > 0)) return timeoutMs;
 	const remaining = timeoutMs - (Date.now() - startedAt);
@@ -2622,14 +3086,20 @@ function createSharedCodexAppServerClientStartup(params) {
 		runtimeArtifactSignal: params.runtimeArtifactSignal,
 		config: params.config,
 		onStartedClient: (startedClient) => {
+			const state = getSharedCodexAppServerClientState();
 			params.entry.client = startedClient;
+			state.entriesByClient.set(startedClient, params.entry);
+			state.liveClients.add(startedClient);
+			startedClient.addCloseHandler((closedClient) => {
+				getSharedCodexAppServerClientState().liveClients.delete(closedClient);
+				clearSharedClientEntryIfCurrent(params.key, closedClient);
+			});
 			for (const callback of params.entry.onStartedClientCallbacks) callback(startedClient);
 			retirePendingSharedClientEntryIfUnclaimed(params.key, params.entry);
 		},
 		onInitializedClient: () => initialized.resolve()
 	}).then((client) => {
 		params.entry.client = client;
-		client.addCloseHandler((closedClient) => clearSharedClientEntryIfCurrent(params.key, closedClient));
 		return client;
 	}, (error) => {
 		initialized.reject(error);
@@ -2669,7 +3139,7 @@ async function startInitializedCodexAppServerClient(params) {
 	const timeoutMs = params.timeoutMs ?? 0;
 	const startOptionsCandidates = resolveManagedFallbackStartOptions(params.startOptions);
 	for (const [index, startOptions] of startOptionsCandidates.entries()) {
-		const runtimeArtifactModule = params.runtimeArtifactMode ? await import("./runtime-artifact-C2ITXdhM.js") : void 0;
+		const runtimeArtifactModule = params.runtimeArtifactMode ? await import("./runtime-artifact-BVSPdd6g.js") : void 0;
 		const nativeCommandBeforeStart = startOptions.commandSource === "resolved-managed" ? resolveManagedCodexNativeCommand(startOptions.command) : void 0;
 		const runtimeArtifactBeforeStart = runtimeArtifactModule ? await runtimeArtifactModule.captureCodexAppServerRuntimeArtifactBeforeStart({
 			startOptions,
@@ -2684,7 +3154,7 @@ async function startInitializedCodexAppServerClient(params) {
 		params.onStartedClient?.(client);
 		let initialize;
 		try {
-			await withCodexAppServerAcquireDeadline(resolveRemainingAcquireTimeout(timeoutMs, acquireStartedAt), initialize = client.initialize(), params.abandonSignal);
+			await withCodexAppServerAcquireDeadline(resolveRemainingAcquireTimeout(timeoutMs, acquireStartedAt), initialize = client.initialize(), params.abandonSignal, CODEX_APP_SERVER_INITIALIZE_TIMEOUT_MESSAGE, () => buildCodexAppServerInitializeTimeoutError(client));
 		} catch (error) {
 			client.close();
 			initialize?.catch(() => void 0);
@@ -2789,6 +3259,19 @@ function retainSharedCodexAppServerClientIfCurrent(client) {
 	const state = getSharedCodexAppServerClientState();
 	for (const entry of state.clients.values()) if (entry.client === client) return retainSharedClientEntry(entry);
 }
+/** Retains the live shared client whose initialized instance id matches a thread binding. */
+function retainSharedCodexAppServerClientByInstanceId(clientId) {
+	const normalizedClientId = clientId?.trim();
+	if (!normalizedClientId) return;
+	for (const entry of getSharedCodexAppServerClientState().clients.values()) {
+		const client = entry.client;
+		if (client?.getInstanceId() !== normalizedClientId || entry.closeWhenIdle || entry.closeError) continue;
+		return {
+			client,
+			release: retainSharedClientEntry(entry)
+		};
+	}
+}
 /**
 * Retires a matching shared client. Default is graceful: detach from the map
 * (future acquisitions get a fresh client) and close once leases drain.
@@ -2806,11 +3289,9 @@ function retireSharedCodexAppServerClientIfCurrent(client, opts) {
 		entry.closeWhenIdle = true;
 		if (opts?.failActiveLeases) {
 			entry.closeError = /* @__PURE__ */ new Error("codex app-server client is closed");
-			const closed = closeRetiredSharedClientEntry(entry);
-			if (closed) suspectClosedClients.add(client);
 			return {
 				activeLeases: entry.activeLeases,
-				closed
+				closed: closeRetiredSharedClientEntry(entry)
 			};
 		}
 		const closed = closeRetiredSharedClientEntryIfIdle(entry);
@@ -2819,18 +3300,17 @@ function retireSharedCodexAppServerClientIfCurrent(client, opts) {
 			closed
 		};
 	}
-	const activeLeases = state.leasedReleases.get(client)?.length ?? 0;
-	if (activeLeases > 0) {
-		if (opts?.failActiveLeases && !suspectClosedClients.has(client)) {
-			suspectClosedClients.add(client);
-			client.close();
+	const detachedEntry = state.entriesByClient.get(client);
+	if (detachedEntry && (detachedEntry.client === client || detachedEntry.closeError)) {
+		if (opts?.failActiveLeases && !detachedEntry.closeError) {
+			detachedEntry.closeError = /* @__PURE__ */ new Error("codex app-server client is closed");
 			return {
-				activeLeases,
-				closed: true
+				activeLeases: detachedEntry.activeLeases,
+				closed: closeRetiredSharedClientEntry(detachedEntry)
 			};
 		}
 		return {
-			activeLeases,
+			activeLeases: detachedEntry.activeLeases,
 			closed: false
 		};
 	}
@@ -2851,6 +3331,7 @@ async function clearSharedCodexAppServerClientAndWait(options) {
 	const state = getSharedCodexAppServerClientState();
 	const clients = collectSharedClients(state);
 	state.clients.clear();
+	state.warmClientsByConfig = /* @__PURE__ */ new WeakMap();
 	await Promise.all(clients.map((client) => client.closeAndWait(options)));
 }
 globalThis[SHARED_CODEX_APP_SERVER_CLIENT_DISPOSER] = clearSharedCodexAppServerClientAndWait;
@@ -2946,7 +3427,7 @@ function retirePendingSharedClientEntryIfUnclaimed(key, entry) {
 	closeRetiredSharedClientEntry(entry);
 }
 function collectSharedClients(state) {
-	return [...new Set([...state.clients.values()].map((entry) => entry.client).filter((client) => Boolean(client)))];
+	return [...state.liveClients];
 }
 //#endregion
-export { withCodexStartupTimeout as $, rememberCodexRateLimitsRead as A, flattenCodexDynamicToolFunctions as B, isCodexAppServerIndeterminateTransportError as C, ensureCodexAppServerClientRuntime as D, resolveCodexAppServerClientInstanceId as E, resolveCodexAppServerPreparedApiKeyCacheKey as F, CodexAppServerStartupError as G, resolveFirstExistingMacOSDesktopCodexBundledMarketplacePath as H, resolveCodexAppServerPreparedAuthHandoff as I, resolveCodexPostToolRawAssistantCompletionIdleTimeoutMs as J, isCodexAppServerStartupError as K, CODEX_INTERACTIVE_CUSTOM_THREAD_SOURCES as L, resolveCodexAppServerAuthProfileId as M, resolveCodexAppServerAuthProfileIdForAgent as N, readCodexRateLimitsRevision as O, resolveCodexAppServerFallbackApiKeyCacheKey as P, resolveCodexTurnTerminalIdleTimeoutMs as Q, CODEX_INTERACTIVE_THREAD_SOURCE_KINDS as R, isCodexAppServerIndeterminateRequestCancellationError as S, isCodexAppServerRequestTimeoutError as T, resolveCodexAppServerHomeDir as U, isJsonObject$1 as V, CODEX_POST_REASONING_REPLY_IDLE_TIMEOUT_MS as W, resolveCodexTurnAssistantCompletionIdleTimeoutMs as X, resolveCodexStartupTimeoutMs as Y, resolveCodexTurnCompletionIdleTimeoutMs as Z, CodexAppServerRpcError as _, getLeasedSharedCodexAppServerClient as a, isCodexAppServerBrokenPipeError as b, releaseCodexAppServerClientLease as c, retainSharedCodexAppServerClientIfCurrent as d, retireSharedCodexAppServerClientIfCurrent as f, acquireCodexNativeConfigFence as g, withTimeout$1 as h, createIsolatedCodexAppServerClient as i, resolveCodexAppServerAuthAccountCacheKey as j, readRecentCodexRateLimits as k, releaseLeasedSharedCodexAppServerClient as l, withLeasedCodexAppServerClientStartSelectionRetry as m, clearSharedCodexAppServerClientIfCurrentAndUnclaimed as n, getSharedCodexAppServerClient as o, shared_client_exports as p, resolveCodexGatewayTimeoutWithGraceMs as q, clearSharedCodexAppServerClientIfCurrentAndWait as r, isCodexAppServerStartSelectionChangedError as s, clearSharedCodexAppServerClientIfCurrent as t, resolveCodexNativeConfigFenceKey as u, getCodexAppServerClientInstanceId as v, isCodexAppServerPrewriteRequestCancellationError as w, isCodexAppServerConnectionClosedError as x, isCodexAppServerApprovalRequest as y, CODEX_OPENCLAW_DIRECT_DYNAMIC_TOOL_NAMESPACE as z };
+export { resolveCodexAppServerAuthProfileId as $, isCodexAppServerApprovalRequest as A, claimCodexAppServerLiveThread as B, resolveCodexPostToolRawAssistantCompletionIdleTimeoutMs as C, resolveCodexTurnTerminalIdleTimeoutMs as D, resolveCodexTurnCompletionIdleTimeoutMs as E, isCodexAppServerPrewriteRequestCancellationError as F, protectCodexAppServerLiveThread as G, ensureCodexAppServerClientRuntime as H, isCodexAppServerRequestTimeoutError as I, unsubscribeCodexAppServerLiveThread as J, releaseCodexAppServerLiveThread as K, isUnsupportedCodexAppServerVersionError as L, isCodexAppServerConnectionClosedError as M, isCodexAppServerIndeterminateRequestCancellationError as N, withCodexStartupTimeout as O, isCodexAppServerIndeterminateTransportError as P, resolveCodexAppServerAuthAccountCacheKey as Q, resolveCodexAppServerClientInstanceId as R, resolveCodexGatewayTimeoutWithGraceMs as S, resolveCodexTurnAssistantCompletionIdleTimeoutMs as T, isCodexAppServerClientRuntimeLive as U, consumeCodexAppServerLiveThread as V, isCodexAppServerLiveThreadClaimed as W, readRecentCodexRateLimits as X, readCodexRateLimitsRevision as Y, rememberCodexRateLimitsRead as Z, withTimeout$1 as _, getLeasedSharedCodexAppServerClient as a, CODEX_INTERACTIVE_THREAD_SOURCE_KINDS as at, CodexAppServerStartupError as b, releaseCodexAppServerClientLease as c, isJsonObject as ct, retainSharedCodexAppServerClientByInstanceId as d, resolveCodexAppServerLocalHomeDir as dt, resolveCodexAppServerAuthProfileIdForAgent as et, retainSharedCodexAppServerClientIfCurrent as f, withAbortableTimeout as g, withLeasedCodexAppServerClientStartSelectionRetry as h, createIsolatedCodexAppServerClient as i, CODEX_INTERACTIVE_CUSTOM_THREAD_SOURCES as it, isCodexAppServerBrokenPipeError as j, getCodexAppServerClientInstanceId as k, releaseLeasedSharedCodexAppServerClient as l, resolveFirstExistingMacOSDesktopCodexBundledMarketplacePath as lt, shared_client_exports as m, clearSharedCodexAppServerClientIfCurrentAndUnclaimed as n, resolveCodexAppServerPreparedApiKeyCacheKey as nt, getSharedCodexAppServerClient as o, CODEX_OPENCLAW_DIRECT_DYNAMIC_TOOL_NAMESPACE as ot, retireSharedCodexAppServerClientIfCurrent as p, retainCodexAppServerLiveThread as q, clearSharedCodexAppServerClientIfCurrentAndWait as r, resolveCodexAppServerPreparedAuthHandoff as rt, isCodexAppServerStartSelectionChangedError as s, flattenCodexDynamicToolFunctions as st, clearSharedCodexAppServerClientIfCurrent as t, resolveCodexAppServerFallbackApiKeyCacheKey as tt, resolveCodexNativeConfigFenceKey as u, resolveCodexAppServerHomeDir as ut, acquireCodexNativeConfigFence as v, resolveCodexStartupTimeoutMs as w, isCodexAppServerStartupError as x, CODEX_POST_REASONING_REPLY_IDLE_TIMEOUT_MS as y, CodexAppServerRpcError as z };