@openclaw/codex 2026.7.2-beta.5 → 2026.8.1-beta.2

package/dist/{transport-stdio-DXgGZ7Ib.js → transport-stdio-DIImwDVS.js}

@@ -10,6 +10,12 @@ const UNSAFE_ENVIRONMENT_KEYS = /* @__PURE__ */ new Set([
 	"constructor",
 	"prototype"
 ]);
+const RUNTIME_INJECTION_ENVIRONMENT_KEYS = /* @__PURE__ */ new Set([
+	"NODE_PATH",
+	"LD_AUDIT",
+	"LD_LIBRARY_PATH",
+	"LD_PRELOAD"
+]);
 const QA_PARENT_PID_ENV = "OPENCLAW_QA_PARENT_PID";
 const DEFAULT_SPAWN_RUNTIME = {
 	platform: process.platform,
@@ -43,8 +49,13 @@ function resolveCodexAppServerSpawnEnv(options, baseEnv = process.env, platform
 		const lowerCaseKeysToClear = new Set(keysToClear.map((key) => key.toLowerCase()));
 		for (const candidate of Object.keys(env)) if (lowerCaseKeysToClear.has(candidate.toLowerCase())) delete env[candidate];
 	} else for (const key of keysToClear) delete env[key];
+	for (const key of Object.keys(env)) if (isCodexRuntimeInjectionEnvironmentKey(key)) delete env[key];
 	return env;
 }
+function isCodexRuntimeInjectionEnvironmentKey(rawKey) {
+	const key = rawKey.toUpperCase();
+	return RUNTIME_INJECTION_ENVIRONMENT_KEYS.has(key) || key.startsWith("DYLD_");
+}
 /** Keeps QA-owned app-server processes inside the gateway process-group cleanup boundary. */
 function resolveCodexAppServerDetachedMode(env, platform = process.platform) {
 	return platform !== "win32" && !env[QA_PARENT_PID_ENV]?.trim();

package/dist/upstream-prompt-provenance-ClRBije0.js

@@ -0,0 +1,41 @@
+//#region extensions/codex/src/app-server/upstream-prompt-provenance.ts
+const UPSTREAM_USER_TEXT_META_KEY = "upstreamUserText";
+const MIRROR_IDENTITY_META_KEY = "mirrorIdentity";
+function attachCodexMirrorIdentity(message, identity) {
+	const record = message;
+	const existing = record["__openclaw"];
+	const baseMeta = existing && typeof existing === "object" && !Array.isArray(existing) ? existing : {};
+	return {
+		...record,
+		__openclaw: {
+			...baseMeta,
+			[MIRROR_IDENTITY_META_KEY]: identity
+		}
+	};
+}
+function readMirrorIdentity(message) {
+	const meta = message["__openclaw"];
+	if (!meta || typeof meta !== "object" || Array.isArray(meta)) return;
+	const id = meta[MIRROR_IDENTITY_META_KEY];
+	return typeof id === "string" && id ? id : void 0;
+}
+function attachUpstreamUserText(message, text) {
+	const record = message;
+	const existing = record["__openclaw"];
+	const baseMeta = existing && typeof existing === "object" && !Array.isArray(existing) ? existing : {};
+	return {
+		...record,
+		__openclaw: {
+			...baseMeta,
+			[UPSTREAM_USER_TEXT_META_KEY]: text
+		}
+	};
+}
+function readUpstreamUserText(message) {
+	const meta = message?.["__openclaw"];
+	if (!meta || typeof meta !== "object" || Array.isArray(meta)) return;
+	const text = meta[UPSTREAM_USER_TEXT_META_KEY];
+	return typeof text === "string" && text ? text : void 0;
+}
+//#endregion
+export { readUpstreamUserText as i, attachUpstreamUserText as n, readMirrorIdentity as r, attachCodexMirrorIdentity as t };

package/dist/{upstream-session-fork-_Vrz4WJr.js → upstream-session-fork-CE-_LdnP.js}

@@ -1,8 +1,8 @@
-import { l as sessionBindingIdentity } from "./session-binding-DlVQ-Pxs.js";
-import { n as assertCodexThreadForkResponse } from "./protocol-validators-Dm4eXZmt.js";
+import { d as sessionBindingIdentity } from "./session-binding-DPxIvMgE.js";
+import { r as assertCodexThreadForkResponse } from "./protocol-validators-B4F7L8Rf.js";
 import { t as isIncognitoSessionKey } from "./incognito-session-ET_ufDH-.js";
-import { i as createImportedCodexSession, n as codexUpstreamBaseline, t as codexLastTerminalTurnId } from "./session-upstream-marker-QE-m5QFG.js";
-import { isRecord } from "openclaw/plugin-sdk/string-coerce-runtime";
+import { i as createImportedCodexSession, n as codexUpstreamBaseline, t as codexLastTerminalTurnId } from "./session-upstream-marker-CrIFX06J.js";
+import { isRecord, normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { readVisibleSessionTranscriptMessageEntries } from "openclaw/plugin-sdk/session-transcript-runtime";
 import { deleteSessionUpstreamLink, upsertSessionUpstreamLink } from "openclaw/plugin-sdk/session-catalog";
 //#region extensions/codex/src/app-server/upstream-fork-boundary.ts
@@ -167,7 +167,7 @@ function readConnectionFingerprint(ref) {
 	return typeof ref.connectionFingerprint === "string" && ref.connectionFingerprint.trim() ? ref.connectionFingerprint : void 0;
 }
 function normalizeTurnId(value) {
-	return typeof value === "string" && value.trim() ? value.trim() : void 0;
+	return normalizeOptionalString(value);
 }
 async function forkCodexUpstreamSession(params, options) {
 	try {

package/dist/{usage-UpVbdX5G.js → usage-CHlV0e-o.js}

@@ -1,6 +1,6 @@
-import { p as resolveCodexAppServerRuntimeOptions } from "./session-binding-DlVQ-Pxs.js";
-import { t as buildCodexAppServerUsageSnapshot } from "./rate-limits-S_PXs0ul.js";
-import { t as readCodexAppServerUsage } from "./request-CXpPennK.js";
+import { g as resolveCodexAppServerRuntimeOptions } from "./session-binding-DPxIvMgE.js";
+import { t as buildCodexAppServerUsageSnapshot } from "./rate-limits-DZXmOL8-.js";
+import { t as readCodexAppServerUsage } from "./request-BRl5_UfX.js";
 import { CODEX_APP_SERVER_AUTH_MARKER } from "openclaw/plugin-sdk/agent-runtime";
 //#region extensions/codex/src/app-server/usage.ts
 /** Handles the synthetic usage credential for a Codex-backed OpenAI route. */

package/dist/{web-search-provider.runtime-CaQMYDbp.js → web-search-provider.runtime-DRw2Vl42.js}

@@ -1,6 +1,7 @@
-import { V as isJsonObject } from "./shared-client-BVKE40c-.js";
-import { m as buildCodexNativeWebSearchThreadConfig } from "./thread-lifecycle-DRg_FdzC.js";
-import { t as runBoundedCodexAppServerTurn } from "./bounded-turn-FEbUXoYT.js";
+import { ct as isJsonObject } from "./shared-client-kIBbGjk4.js";
+import { d as buildCodexNativeWebSearchThreadConfig } from "./thread-lifecycle-Bu1BTDXr.js";
+import { t as runBoundedCodexAppServerTurn } from "./bounded-turn-qgZmzy_4.js";
+import { normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { readStringParam, resolveSearchTimeoutSeconds, wrapWebContent } from "openclaw/plugin-sdk/provider-web-search";
 //#region extensions/codex/src/web-search-provider.runtime.ts
 async function executeCodexWebSearchProviderTool(ctx, args, executionContext, options) {
@@ -9,6 +10,7 @@ async function executeCodexWebSearchProviderTool(ctx, args, executionContext, op
 	const result = await runBoundedCodexAppServerTurn({
 		config: ctx.config,
 		model: { mode: "live-default" },
+		modelProvider: "openai",
 		timeoutMs: resolveSearchTimeoutSeconds(ctx.searchConfig) * 1e3,
 		signal: executionContext?.signal,
 		agentDir: ctx.agentDir,
@@ -45,7 +47,7 @@ function summarizeCodexWebSearchItem(item) {
 	const action = isJsonObject(item.action) ? item.action : void 0;
 	const actionType = readNonEmptyString(action, "type");
 	const queries = actionType === "search" ? readNonEmptyStringArray(action, "queries") : [];
-	const query = normalizeNonEmptyString(item.query) ?? (actionType === "search" ? readNonEmptyString(action, "query") : void 0) ?? queries[0];
+	const query = normalizeOptionalString(item.query) ?? (actionType === "search" ? readNonEmptyString(action, "query") : void 0) ?? queries[0];
 	const url = readNonEmptyString(action, "url");
 	const pattern = readNonEmptyString(action, "pattern");
 	return {
@@ -57,18 +59,15 @@ function summarizeCodexWebSearchItem(item) {
 	};
 }
 function readNonEmptyString(record, key) {
-	return record ? normalizeNonEmptyString(record[key]) : void 0;
+	return record ? normalizeOptionalString(record[key]) : void 0;
 }
 function readNonEmptyStringArray(record, key) {
 	const value = record?.[key];
 	if (!Array.isArray(value)) return [];
 	return value.flatMap((entry) => {
-		const normalized = normalizeNonEmptyString(entry);
+		const normalized = normalizeOptionalString(entry);
 		return normalized ? [normalized] : [];
 	});
 }
-function normalizeNonEmptyString(value) {
-	return typeof value === "string" ? value.trim() || void 0 : void 0;
-}
 //#endregion
 export { executeCodexWebSearchProviderTool };

package/openclaw.plugin.json

@@ -1,5 +1,19 @@
 {
   "id": "codex",
+  "doctorContract": {
+    "configRepair": true,
+    "stateMigrations": true
+  },
+  "sessionRouteStateOwners": [
+    {
+      "id": "codex",
+      "label": "Codex",
+      "providerIds": ["codex", "codex-cli", "openai-codex"],
+      "runtimeIds": ["codex", "codex-cli"],
+      "cliSessionKeys": ["codex-cli"],
+      "authProfilePrefixes": ["codex:", "codex-cli:", "openai-codex:"]
+    }
+  ],
   "name": "Codex",
   "description": "Codex app-server harness and native session catalog.",
   "contracts": {
@@ -7,6 +21,7 @@
     "migrationProviders": ["codex"],
     "tools": [
       "codex_threads",
+      "codex_plugins",
       "codex_endpoint_probe",
       "codex_sessions_list",
       "codex_session_read",
@@ -28,6 +43,7 @@
     "onAgentHarnesses": ["codex"],
     "onCommands": ["codex"],
     "onConfigPaths": [
+      "plugins.entries.codex.config.appServer.transport",
       "plugins.entries.codex.config.sessionCatalog.enabled",
       "plugins.entries.codex.config.supervision.enabled"
     ]
@@ -167,7 +183,7 @@
                 },
                 "marketplaceName": {
                   "type": "string",
-                  "enum": ["openai-curated", "workspace-directory"]
+                  "pattern": "^[A-Za-z0-9_-]+$"
                 },
                 "pluginName": {
                   "type": "string"
@@ -235,8 +251,7 @@
           },
           "homeScope": {
             "type": "string",
-            "enum": ["agent", "user"],
-            "default": "agent"
+            "enum": ["agent", "user"]
           },
           "command": { "type": "string" },
           "args": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openclaw/codex",
-  "version": "2026.7.2-beta.5",
+  "version": "2026.8.1-beta.2",
   "description": "OpenClaw Codex app-server harness and native session supervision plugin.",
   "repository": {
     "type": "git",
@@ -8,9 +8,8 @@
   },
   "type": "module",
   "dependencies": {
-    "@openai/codex": "0.145.0",
-    "semver": "7.8.5",
-    "smol-toml": "1.7.0",
+    "@openai/codex": "0.147.0",
+    "smol-toml": "1.7.1",
     "typebox": "1.3.6",
     "ws": "8.21.1",
     "zod": "4.4.3"
@@ -36,10 +35,10 @@
       ]
     },
     "compat": {
-      "pluginApi": ">=2026.7.2-beta.5"
+      "pluginApi": ">=2026.8.1-beta.2"
     },
     "build": {
-      "openclawVersion": "2026.7.2-beta.5"
+      "openclawVersion": "2026.8.1-beta.2"
     },
     "release": {
       "publishToClawHub": true,
@@ -59,7 +58,7 @@
     "README.md"
   ],
   "peerDependencies": {
-    "openclaw": ">=2026.7.2-beta.5"
+    "openclaw": ">=2026.8.1-beta.2"
   },
   "peerDependenciesMeta": {
     "openclaw": {

package/dist/attempt-client-cleanup-Ia52yRWc.js

@@ -1,127 +0,0 @@
-import { f as retireSharedCodexAppServerClientIfCurrent, n as clearSharedCodexAppServerClientIfCurrentAndUnclaimed, t as clearSharedCodexAppServerClientIfCurrent } from "./shared-client-BVKE40c-.js";
-import { embeddedAgentLog } from "openclaw/plugin-sdk/agent-harness-runtime";
-//#region extensions/codex/src/app-server/attempt-client-cleanup.ts
-/**
-* Best-effort cleanup helpers for Codex app-server startup attempts and turns.
-*/
-/** Timeout for best-effort app-server turn interruption during cleanup. */
-const CODEX_APP_SERVER_INTERRUPT_TIMEOUT_MS = 5e3;
-/** Timeout for best-effort thread unsubscribe during cleanup. */
-const CODEX_APP_SERVER_UNSUBSCRIBE_TIMEOUT_MS = 5e3;
-/** Raised when a thread subscription may be live on a client OpenClaw no longer controls. */
-var CodexAppServerUnsafeSubscriptionError = class extends Error {
-	constructor(message, options) {
-		super(message, options);
-		this.name = "CodexAppServerUnsafeSubscriptionError";
-	}
-};
-function isCodexAppServerUnsafeSubscriptionError(error) {
-	return error instanceof CodexAppServerUnsafeSubscriptionError;
-}
-/** Asserts Codex resumed the exact thread this attempt subscribed to. */
-function assertCodexThreadResumeSubscription(requestedThreadId, returnedThreadId) {
-	if (returnedThreadId !== requestedThreadId) throw new CodexAppServerUnsafeSubscriptionError(`Codex thread/resume returned ${returnedThreadId} for ${requestedThreadId}`);
-}
-async function closeClientAndWaitIfAvailable(client) {
-	const closeable = client;
-	if (typeof closeable.closeAndWait === "function") {
-		await closeable.closeAndWait();
-		return;
-	}
-	closeable.close?.();
-}
-async function closeCodexStartupClientBestEffort(client) {
-	if (!client) return;
-	const unclaimedSharedClient = clearSharedCodexAppServerClientIfCurrentAndUnclaimed(client);
-	if (unclaimedSharedClient.closed) {
-		await closeClientAndWaitIfAvailable(client);
-		return;
-	}
-	if (unclaimedSharedClient.found) {
-		if (retireSharedCodexAppServerClientIfCurrent(client)?.closed) await closeClientAndWaitIfAvailable(client);
-		return;
-	}
-	const retiredSharedClient = retireSharedCodexAppServerClientIfCurrent(client);
-	if (retiredSharedClient) {
-		if (retiredSharedClient.closed) await closeClientAndWaitIfAvailable(client);
-		return;
-	}
-	if (clearSharedCodexAppServerClientIfCurrent(client)) {
-		await closeClientAndWaitIfAvailable(client);
-		return;
-	}
-	await closeClientAndWaitIfAvailable(client);
-}
-/** Sends a turn interrupt without blocking abort cleanup on app-server errors. */
-function interruptCodexTurnBestEffort(client, params) {
-	interruptCodexTurnAndWaitBestEffort(client, params);
-}
-/** Sends a bounded turn interrupt and waits for Codex to confirm terminal abort handling. */
-async function interruptCodexTurnAndWaitBestEffort(client, params) {
-	const requestOptions = params.timeoutMs && Number.isFinite(params.timeoutMs) && params.timeoutMs > 0 ? { timeoutMs: params.timeoutMs } : void 0;
-	const requestParams = {
-		threadId: params.threadId,
-		turnId: params.turnId
-	};
-	try {
-		await (requestOptions ? client.request("turn/interrupt", requestParams, requestOptions) : client.request("turn/interrupt", requestParams));
-	} catch (error) {
-		embeddedAgentLog.debug("codex app-server turn interrupt failed during abort", { error });
-	}
-}
-/** Unsubscribes from a thread while swallowing cleanup-only failures. */
-async function unsubscribeCodexThreadBestEffort(client, params) {
-	try {
-		await client.request("thread/unsubscribe", { threadId: params.threadId }, { timeoutMs: params.timeoutMs });
-		return true;
-	} catch (error) {
-		embeddedAgentLog.debug("codex app-server thread unsubscribe cleanup failed", {
-			threadId: params.threadId,
-			error
-		});
-		return false;
-	}
-}
-/**
-* Retires the shared client after a timed-out turn so later runs do not reuse a
-* potentially wedged app-server connection.
-*/
-async function retireCodexAppServerClientAfterTimedOutTurn(client, params) {
-	const retiredSharedClient = retireSharedCodexAppServerClientIfCurrent(client, { failActiveLeases: params.suspectPhysicalClient });
-	const detachedSharedClient = Boolean(retiredSharedClient);
-	if (!(params.suspectPhysicalClient && (retiredSharedClient?.closed ?? false))) {
-		interruptCodexTurnBestEffort(client, {
-			threadId: params.threadId,
-			turnId: params.turnId,
-			timeoutMs: CODEX_APP_SERVER_INTERRUPT_TIMEOUT_MS
-		});
-		await unsubscribeCodexThreadBestEffort(client, {
-			threadId: params.threadId,
-			timeoutMs: CODEX_APP_SERVER_UNSUBSCRIBE_TIMEOUT_MS
-		});
-	}
-	let closedClient = retiredSharedClient?.closed ?? false;
-	if (!detachedSharedClient) {
-		const close = client.close;
-		if (typeof close === "function") try {
-			close.call(client);
-			closedClient = true;
-		} catch (error) {
-			embeddedAgentLog.debug("codex app-server client close failed during timeout cleanup", {
-				threadId: params.threadId,
-				turnId: params.turnId,
-				error
-			});
-		}
-	}
-	embeddedAgentLog.warn("codex app-server client retired after timed-out turn", {
-		threadId: params.threadId,
-		turnId: params.turnId,
-		reason: params.reason,
-		detachedSharedClient,
-		closedClient,
-		activeSharedClientLeases: retiredSharedClient?.activeLeases ?? 0
-	});
-}
-//#endregion
-export { closeCodexStartupClientBestEffort as a, isCodexAppServerUnsafeSubscriptionError as c, assertCodexThreadResumeSubscription as i, retireCodexAppServerClientAfterTimedOutTurn as l, CODEX_APP_SERVER_UNSUBSCRIBE_TIMEOUT_MS as n, interruptCodexTurnAndWaitBestEffort as o, CodexAppServerUnsafeSubscriptionError as r, interruptCodexTurnBestEffort as s, CODEX_APP_SERVER_INTERRUPT_TIMEOUT_MS as t, unsubscribeCodexThreadBestEffort as u };

package/dist/conversation-control-DE7d9DOj.js

@@ -1,287 +0,0 @@
-import { a as getLeasedSharedCodexAppServerClient, c as releaseCodexAppServerClientLease, l as releaseLeasedSharedCodexAppServerClient, m as withLeasedCodexAppServerClientStartSelectionRetry } from "./shared-client-BVKE40c-.js";
-import { O as isCodexFastServiceTier, S as resolveCodexModelBackedReviewerPolicyContext, o as isCodexAppServerNativeAuthProfile, p as resolveCodexAppServerRuntimeOptions, r as bindingStoreKey, s as normalizeCodexAppServerBindingModelProvider } from "./session-binding-DlVQ-Pxs.js";
-import { x as resolveCodexBindingModelProviderFallback, y as resolveCodexAppServerRequestModelSelection } from "./thread-lifecycle-DRg_FdzC.js";
-import { t as CODEX_CONTROL_METHODS } from "./capabilities-BHRSI6Cn.js";
-import { r as formatCodexDisplayText } from "./command-formatters-ico4ZFnk.js";
-import { a as resolveCodexBindingAppServerConnection } from "./notification-correlation-Bj_Ak_jI.js";
-import { ModelSelectionLockedError } from "openclaw/plugin-sdk/model-session-runtime";
-//#region extensions/codex/src/command-authorization.ts
-const CODEX_NATIVE_EXECUTION_AUTH_ERROR = "Only an owner or operator.admin can control Codex native execution.";
-function canMutateCodexHost(ctx) {
-	return ctx.senderIsOwner === true || ctx.gatewayClientScopes?.includes("operator.admin") === true;
-}
-//#endregion
-//#region extensions/codex/src/conversation-control.ts
-const CODEX_CONVERSATION_CONTROL_STATE = Symbol.for("openclaw.codex.conversationControl");
-function getActiveTurns() {
-	const globalState = globalThis;
-	globalState[CODEX_CONVERSATION_CONTROL_STATE] ??= /* @__PURE__ */ new Map();
-	return globalState[CODEX_CONVERSATION_CONTROL_STATE];
-}
-function trackCodexConversationActiveTurn(active) {
-	const activeTurns = getActiveTurns();
-	const key = bindingStoreKey(active.identity);
-	activeTurns.set(key, active);
-	return () => {
-		if (activeTurns.get(key)?.turnId === active.turnId) activeTurns.delete(key);
-	};
-}
-function readCodexConversationActiveTurn(identity) {
-	return getActiveTurns().get(bindingStoreKey(identity));
-}
-async function stopCodexConversationTurn(params) {
-	const active = readCodexConversationActiveTurn(params.identity);
-	if (!active) return {
-		stopped: false,
-		message: "No active Codex run to stop."
-	};
-	const lookup = buildBindingLookup(params);
-	const binding = await params.bindingStore.read(params.identity);
-	if (binding?.threadId !== active.threadId) return {
-		stopped: false,
-		message: "The active Codex run no longer matches this session binding."
-	};
-	const connection = resolveCodexBindingAppServerConnection({
-		binding,
-		authProfileId: binding?.authProfileId,
-		pluginConfig: params.pluginConfig
-	});
-	const runtime = connection.appServer;
-	const client = active.client ?? await getLeasedSharedCodexAppServerClient({
-		startOptions: runtime.start,
-		timeoutMs: runtime.requestTimeoutMs,
-		authProfileId: connection.clientAuthProfileId,
-		...lookup
-	});
-	try {
-		await client.request("turn/interrupt", {
-			threadId: active.threadId,
-			turnId: active.turnId
-		}, { timeoutMs: runtime.requestTimeoutMs });
-	} finally {
-		if (!active.client) releaseLeasedSharedCodexAppServerClient(client);
-	}
-	return {
-		stopped: true,
-		message: "Codex stop requested."
-	};
-}
-async function steerCodexConversationTurn(params) {
-	const active = readCodexConversationActiveTurn(params.identity);
-	const text = params.message.trim();
-	if (!text) return {
-		steered: false,
-		message: "Usage: /codex steer <message>"
-	};
-	if (!active) return {
-		steered: false,
-		message: "No active Codex run to steer."
-	};
-	const lookup = buildBindingLookup(params);
-	const binding = await params.bindingStore.read(params.identity);
-	if (binding?.threadId !== active.threadId) return {
-		steered: false,
-		message: "The active Codex run no longer matches this session binding."
-	};
-	const connection = resolveCodexBindingAppServerConnection({
-		binding,
-		authProfileId: binding?.authProfileId,
-		pluginConfig: params.pluginConfig
-	});
-	const runtime = connection.appServer;
-	const client = active.client ?? await getLeasedSharedCodexAppServerClient({
-		startOptions: runtime.start,
-		timeoutMs: runtime.requestTimeoutMs,
-		authProfileId: connection.clientAuthProfileId,
-		...lookup
-	});
-	try {
-		await client.request("turn/steer", {
-			threadId: active.threadId,
-			expectedTurnId: active.turnId,
-			input: [{
-				type: "text",
-				text,
-				text_elements: []
-			}]
-		}, { timeoutMs: runtime.requestTimeoutMs });
-	} finally {
-		if (!active.client) releaseLeasedSharedCodexAppServerClient(client);
-	}
-	return {
-		steered: true,
-		message: "Sent steer message to Codex."
-	};
-}
-async function setCodexConversationModel(params) {
-	const model = params.model.trim();
-	if (!model) return "Usage: /codex model <model>";
-	const lookup = buildBindingLookup(params);
-	const binding = await requireThreadBinding(params.bindingStore, params.identity);
-	if (binding.connectionScope === "supervision") throw new ModelSelectionLockedError();
-	const reviewerPolicyContext = resolveCodexModelBackedReviewerPolicyContext({
-		provider: "codex",
-		model,
-		bindingModelProvider: binding.modelProvider,
-		bindingModel: binding.model,
-		nativeAuthProfile: isCodexAppServerNativeAuthProfile({
-			authProfileId: binding.authProfileId,
-			...lookup
-		})
-	});
-	const runtime = resolveCodexAppServerRuntimeOptions({
-		pluginConfig: params.pluginConfig,
-		modelProvider: reviewerPolicyContext.modelProvider,
-		model: reviewerPolicyContext.model,
-		config: params.config,
-		agentDir: params.agentDir
-	});
-	const modelSelection = resolveCodexAppServerRequestModelSelection({
-		model,
-		modelProvider: resolveConversationControlModelProvider({
-			authProfileId: binding.authProfileId,
-			bindingModel: binding.model,
-			bindingModelProvider: binding.modelProvider,
-			currentModel: model,
-			...lookup
-		}),
-		authProfileId: binding.authProfileId,
-		...lookup
-	});
-	const resumed = await resumeThreadWithOverrides({
-		runtime,
-		threadId: binding.threadId,
-		authProfileId: binding.authProfileId,
-		...lookup,
-		model: modelSelection.model,
-		modelProvider: modelSelection.modelProvider
-	});
-	const response = resumed.response;
-	const nextModel = response.model ?? modelSelection.model;
-	const nextModelProvider = normalizeCodexAppServerBindingModelProvider({
-		authProfileId: binding.authProfileId,
-		modelProvider: response.modelProvider ?? modelSelection.modelProvider,
-		...lookup
-	});
-	const modelChanged = nextModel !== binding.model || nextModelProvider !== binding.modelProvider;
-	await patchThreadBinding(params.bindingStore, params.identity, binding.threadId, {
-		clientId: resumed.clientId,
-		cwd: response.thread.cwd ?? binding.cwd,
-		model: nextModel,
-		modelProvider: nextModelProvider,
-		...modelChanged && binding.contextEngine?.projection ? { contextEngine: {
-			...binding.contextEngine,
-			projection: void 0
-		} } : {},
-		approvalPolicy: binding.approvalPolicy,
-		sandbox: binding.sandbox,
-		serviceTier: binding.serviceTier ?? runtime.serviceTier ?? void 0
-	});
-	return `Codex model set to ${formatCodexDisplayText(response.model ?? model)}.`;
-}
-async function setCodexConversationFastMode(params) {
-	const binding = await requireThreadBinding(params.bindingStore, params.identity);
-	if (params.enabled == null) return `Codex fast mode: ${isCodexFastServiceTier(binding.serviceTier) ? "on" : "off"}.`;
-	const serviceTier = params.enabled ? "priority" : "flex";
-	await patchThreadBinding(params.bindingStore, params.identity, binding.threadId, { serviceTier });
-	return `Codex fast mode ${params.enabled ? "enabled" : "disabled"}.`;
-}
-async function setCodexConversationPermissions(params) {
-	const binding = await requireThreadBinding(params.bindingStore, params.identity);
-	if (!params.mode) return `Codex permissions: ${formatPermissionsMode(binding)}.`;
-	const policy = permissionsForMode(params.mode);
-	await patchThreadBinding(params.bindingStore, params.identity, binding.threadId, {
-		approvalPolicy: policy.approvalPolicy,
-		sandbox: policy.sandbox
-	});
-	return `Codex permissions set to ${params.mode === "yolo" ? "full access" : "default"}.`;
-}
-function parseCodexFastModeArg(arg) {
-	const normalized = arg?.trim().toLowerCase();
-	if (!normalized || normalized === "status") return;
-	if (normalized === "on" || normalized === "true" || normalized === "fast") return true;
-	if (normalized === "off" || normalized === "false" || normalized === "flex") return false;
-}
-function parseCodexPermissionsModeArg(arg) {
-	const normalized = arg?.trim().toLowerCase();
-	if (!normalized || normalized === "status") return;
-	if (normalized === "yolo" || normalized === "full" || normalized === "full-access") return "yolo";
-	if (normalized === "default" || normalized === "guardian") return "default";
-}
-function formatPermissionsMode(binding) {
-	return binding.approvalPolicy === "never" && binding.sandbox === "danger-full-access" ? "full access" : "default";
-}
-async function requireThreadBinding(bindingStore, identity) {
-	const binding = await bindingStore.read(identity);
-	if (!binding?.threadId) throw new Error("No Codex thread is attached to this OpenClaw session yet.");
-	return binding;
-}
-async function patchThreadBinding(bindingStore, identity, threadId, patch) {
-	if (!await bindingStore.mutate(identity, {
-		kind: "patch",
-		threadId,
-		patch
-	})) throw new Error("Codex thread binding changed while applying the control update.");
-}
-async function resumeThreadWithOverrides(params) {
-	const runtime = params.runtime;
-	const clientOptions = {
-		startOptions: runtime.start,
-		timeoutMs: runtime.requestTimeoutMs,
-		authProfileId: params.authProfileId,
-		...buildBindingLookup(params)
-	};
-	let client = await getLeasedSharedCodexAppServerClient(clientOptions);
-	const clientLease = { client };
-	try {
-		return {
-			response: await withLeasedCodexAppServerClientStartSelectionRetry({
-				lease: clientLease,
-				options: clientOptions,
-				run: async (requestClient, requestOptions) => await requestClient.request(CODEX_CONTROL_METHODS.resumeThread, {
-					threadId: params.threadId,
-					...params.model ? { model: params.model } : {},
-					...params.modelProvider ? { modelProvider: params.modelProvider } : {},
-					approvalPolicy: params.approvalPolicy ?? runtime.approvalPolicy,
-					sandbox: params.sandbox ?? runtime.sandbox,
-					approvalsReviewer: runtime.approvalsReviewer,
-					...params.serviceTier ? { serviceTier: params.serviceTier } : {}
-				}, requestOptions),
-				onClientChange: (nextClient) => {
-					client = nextClient;
-				}
-			}),
-			clientId: client.getInstanceId()
-		};
-	} finally {
-		releaseCodexAppServerClientLease(clientLease);
-	}
-}
-function buildBindingLookup(params) {
-	const agentDir = params.agentDir?.trim();
-	return {
-		...agentDir ? { agentDir } : {},
-		...params.config ? { config: params.config } : {}
-	};
-}
-function resolveConversationControlModelProvider(params) {
-	const modelProvider = resolveCodexBindingModelProviderFallback({
-		currentModel: params.currentModel,
-		bindingModel: params.bindingModel,
-		bindingModelProvider: params.bindingModelProvider
-	})?.trim();
-	if (!modelProvider || modelProvider.toLowerCase() === "codex") return;
-	if (isCodexAppServerNativeAuthProfile(params) && modelProvider.toLowerCase() === "openai") return;
-	return modelProvider.toLowerCase() === "openai" ? "openai" : modelProvider;
-}
-function permissionsForMode(mode) {
-	return mode === "yolo" ? {
-		approvalPolicy: "never",
-		sandbox: "danger-full-access"
-	} : {
-		approvalPolicy: "on-request",
-		sandbox: "workspace-write"
-	};
-}
-//#endregion
-export { setCodexConversationFastMode as a, steerCodexConversationTurn as c, CODEX_NATIVE_EXECUTION_AUTH_ERROR as d, canMutateCodexHost as f, readCodexConversationActiveTurn as i, stopCodexConversationTurn as l, parseCodexFastModeArg as n, setCodexConversationModel as o, parseCodexPermissionsModeArg as r, setCodexConversationPermissions as s, formatPermissionsMode as t, trackCodexConversationActiveTurn as u };